The scams will have a mention as well just for completeness sake.
Legitimacy of Cloud Mining is proven only when the cloud miner is providing its mining address(es) and sold hash power in real time. Showing hardware, having vouch from hardware vendor, showing payment proof, showing hardware's photo/video - can all be faked. In fact, all of them have been faked already by various players before they went belly up. But, none of the current players still show their mining address(es) and sold hash power in real time. So, you can safely assume, either they have no hash power or involved in partial reserve mining. Both makes them Ponzi. So, below is a list of cloud miners in alphabetical order, that are currently paying but have not proven that they are NOT Ponzi...
1. www.Bit-X.com
2. www.CloudMining.website
3. www.Genesis-Mining.com
4. www.HashFlare.io
5. www.HashNest.com