There's no way to find a legit ICO, it depends mostly on your luck. The best you can do is to look at the ICO's team and their experience, try to find them on LinkedIn or Rocketreach. Also read their whitepaper and decide if their idea is good. Moreover check ICO rating on icobench and icostats
That is true, but there are still some ways to avoid obvious scams, for example, too big hardcap or fake team member information are easy to be scams. Also, you can check if it is hot in telegram by keep an eye on the telegram channel.