ICO rating sites are mostly paid to review right now, so simply pay more and you will get more score. The only remaining legit way to check a project is by doing your own research as you said. ICO rating sites will not lie about the information but the overall review itself can be easily manipulated, so you can use ICO rating sites to collect some basic information about the project but never trust rating site overall review or KYC, do your own KYC through social media it is easy to spot fake un-legit accounts.