If it's a token and not a coin, there's a higher chance it could be a scam. Obviously not all tokens are scams, but coins with their own blockchain are most likely to be legit.
Avoid meme tokens, tokens with no use cases, newly released tokens, and tokens advertised on /r/cryptomoonshots.
Always check who is behind the project. If the team is not doxxed or they have fake pictures, it's a big red flag.
Don't assume a project is legit just because the liquidity is locked. They can still rug pull or find other ways to scam everyone.
It's a good idea to read the whitepaper and roadmap, but remember there is no guarantee the team will stick to them.