The zone-filtering advice above is solid, but worth understanding why pop traffic specifically has this problem more than other formats. Pop/popunder inherently has weaker engagement signals to filter against — the user didn't click an ad creative, they just had a tab open. That makes it much easier for fraudulent traffic to blend in since there's no creative-click data point to validate against.
Where this actually plays out: networks selling "raw" pop inventory without any fraud filtering on their end push that burden entirely onto you. The ones doing real-time bot detection (device fingerprinting, behavioral signals, not just IP blacklists) before the click hits your tracker are doing meaningfully more work than ones that just sell volume and let you sort it out after the fact.
Worth comparing anti-fraud tech specifically (not just CPM rates) when picking a popunder network — some networks are far more transparent about their filtering methodology than others. I put together a comparison covering exactly that at ADSWikia.com (https://adswikia.com/top-networks/best-popunder-advertising-networks/8) if it helps narrow down which ones actually invest in fraud prevention vs just sell raw volume