Here are the three best ways I know of for hack-checking.
1 – Wonder Trade
You got it through Wonder Trade, right? That means it passed the WT hack checker. It has legit stats, legit moves, a legit ability and legit Shininess. I've recieved Shiny Legendaries through WT (once in a blue moon). Granted, they could still be hacked, but they're about as close to a "legit hack" as you can get.
2 – Pokémon Bank
PokéBank. The be-all and end-all of hack checks. If you have doubts as to the legitimacy of your Pokémon, try and deposit it in the Pokémon Bank. Its hack-checker is so good it sometimes refuses legit Pokémon.
3 – Check it Yourself
"Oh look, my Parasect has Sturdy!" should be enough to send off warning lights in your head. If your Shiny Wonder Trade Ho-Oh has Origin Pulse then I'm sorry, but if you can't tell that's a hack then you need professional help.