Today I saw a strange pop up entitled with logo of my ISP while I was browsing a random page. First I thought it was an ad added by site owner but when I check closely it was even on an another pop up. I checked the source and saw that it was clearly coming from somewhere else. An iframe added to page by using a JS script that sourced from direct IP address. No domain, just an IP and path. I am sure it wasn't part of site because iframe was just a static page. It doesn't contain any tracker links that can be seen every ad today. When I refreshed the page, pop up disappeared.
This page could be my mail or bank account or anything that might contain private information. Is there any practical way to prevent something like this?