Checking the legitimacy of an ICO is quite tricky and from my experience Scam ICO's are too hard to tell. Some schemers are too careful and too good at what they do in deceiving people you'll never know anything about it until it is already too late.
There are common guidelines but im not really sure if that will help.
First on the list is check their website and their product. Check the number of their own community. Their participants and investors that are already part of the project. The level of significance of their project and its demand level, Their goals and road map.