One thing for sure is to check the URL if it is secured. Most URL's with the LOCK sign is 80% real. Wierd URL's, I won't waste my time. The whitepaper is also very critical in checking for real ICO. Most scammers don't do any proper writings and designs.
The qualification of the team is also a key. Most of the times, project managers who use Avatars and no social media information and do not share any proper information about themselves are not all that to be trusted.
The website of the project is another factor to check of. Shun websites which will give an input for credit card and passwords.