Pretty simple question. At the moment 99.999% of new coins tokens and crypto project all have a telegram group (full spam and bounty hunters) , a twitter account that only posts pre-made bullish news about their own coin, a subreddit with 20 subscribers and 5 bots, a Facebook page full of 3rd world country princes asking for your eth private key.
What is left to judge a product? Only their website. But how accurate and trustworthy can a website be? White paper too aren't to be trusted, since 90% of the time they get changed work-in-progress.
What metrics do you use?
This is the difficult part in judging the ICOs if legit or not. I will just check if those team and advisors are truly connected to the project and has clear vision that the project will definitely develop on their given time-frame. Besides that I will use my instinct and understanding about crypto if I will invest or not.