One of the hardest things to check for (and what 99.99% of hackers disregard) is ID legality.
Eggs are the easiest to fake, without a doubt. There is no PID/IV relevance.
For Wild Pokemon:
IV-PID Relationship is the biggest way of checking.
Sync checks as well, in addition to Encounter Slots. Legal only does DPPt sync checks, but there is another app that checks both DPPt+HGSS, and encounter slots.
Use PokeGen and a guide for it, and you will create something "legal" enough. But you should never pass something off as "legit".