
They're never legitimate
By definition, a popunder is claiming an ad impression that doesn't exist, because the purported viewer doesn't see it.
Usually it doesn't even get rendered at all, users either close the entire browser window (so all the popunder tabs are gone and never rendered), or they open something else - possibly generating another popunder tab.
The only case they're even theoretically visible is if the viewer closes the tab they wanted. They'll then close the popunder as fast as they possibly can.
Anything "below the fold" is never even rendered for a single frame.
So they're always fraudulent, by design.