Great question. You'll have to become somewhat of a detective and use various tools to make the determination.
I always start with our IP Address Lookup tool to see which country to which the IP is assigned.
From there, I might search for the IP address on Google and use other information found to determine if the IP is safe or not.
If you can tell how many times an IP is making an attempt to connect to you can also be a determining factor. Anything faster than what a human can do naturally is very suspicious.