Have contents of email have been changed in transit?





.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}







1















A colleague of mine received some bank details in an unsecured email from a company. He used the details in the email to pay a sum of money into an account.



The company that sent him the email to him didn't receive the money. The bank account details in the email that he received were different to the ones sent by the company.



Does this sound plausible? Is this the sort of thing that happens? If this has actually happened as described then where would the point of attack be?




  • Has my colleague's PC been hacked?

  • Has the companies network been hacked?

  • Has somebody intercepted the email and changed the details en-route?


What's the most likely scenario?










share|improve this question





























    1















    A colleague of mine received some bank details in an unsecured email from a company. He used the details in the email to pay a sum of money into an account.



    The company that sent him the email to him didn't receive the money. The bank account details in the email that he received were different to the ones sent by the company.



    Does this sound plausible? Is this the sort of thing that happens? If this has actually happened as described then where would the point of attack be?




    • Has my colleague's PC been hacked?

    • Has the companies network been hacked?

    • Has somebody intercepted the email and changed the details en-route?


    What's the most likely scenario?










    share|improve this question

























      1












      1








      1








      A colleague of mine received some bank details in an unsecured email from a company. He used the details in the email to pay a sum of money into an account.



      The company that sent him the email to him didn't receive the money. The bank account details in the email that he received were different to the ones sent by the company.



      Does this sound plausible? Is this the sort of thing that happens? If this has actually happened as described then where would the point of attack be?




      • Has my colleague's PC been hacked?

      • Has the companies network been hacked?

      • Has somebody intercepted the email and changed the details en-route?


      What's the most likely scenario?










      share|improve this question














      A colleague of mine received some bank details in an unsecured email from a company. He used the details in the email to pay a sum of money into an account.



      The company that sent him the email to him didn't receive the money. The bank account details in the email that he received were different to the ones sent by the company.



      Does this sound plausible? Is this the sort of thing that happens? If this has actually happened as described then where would the point of attack be?




      • Has my colleague's PC been hacked?

      • Has the companies network been hacked?

      • Has somebody intercepted the email and changed the details en-route?


      What's the most likely scenario?







      email security man-in-the-middle






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Feb 5 at 8:41









      DavePDaveP

      63




      63






















          2 Answers
          2






          active

          oldest

          votes


















          1














          This is plausible.



          This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.



          It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.



          I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.



          Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.






          share|improve this answer































            0














            This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.



            However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.



            The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).



            Steps to take:




            1. Contact the bank to stop any payments

            2. Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).

            3. Report the infringement / fraud (he will need to check who to report this to in his country).

            4. Check the email headers and black list the originator if possible.


            Aside



            If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email






            share|improve this answer


























            • Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...

              – DaveP
              Feb 5 at 9:16













            • Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.

              – Clinton
              Feb 5 at 9:20













            • @clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.

              – davidgo
              Feb 5 at 10:16











            • Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.

              – Clinton
              Feb 5 at 11:40






            • 1





              @clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.

              – davidgo
              Feb 5 at 18:47












            Your Answer








            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "3"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1402159%2fhave-contents-of-email-have-been-changed-in-transit%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            1














            This is plausible.



            This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.



            It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.



            I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.



            Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.






            share|improve this answer




























              1














              This is plausible.



              This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.



              It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.



              I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.



              Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.






              share|improve this answer


























                1












                1








                1







                This is plausible.



                This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.



                It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.



                I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.



                Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.






                share|improve this answer













                This is plausible.



                This is an attack that could conceivably be performed by anyone who simply knew that your colleague and the company had a business relationship. They could simply send an email pretending to be from the company, but substitute their own payment information instead. It is something that happens with some frequency.



                It is possible that your colleague's email has been compromised. That would give the thief access to a typical email from the company that they could base their fraud on. Not required, but it could simplify their job.



                I think it is unlikely that someone altered this email in-transit. That's typically inconvenient (far from impossible; just inconvenient) when compared to the two approaches above.



                Your colleague should report the issue to their IT security team (if any), and then probably their bank and their insurance company.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered Feb 5 at 8:59









                SlartibartfastSlartibartfast

                6,46621724




                6,46621724

























                    0














                    This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.



                    However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.



                    The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).



                    Steps to take:




                    1. Contact the bank to stop any payments

                    2. Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).

                    3. Report the infringement / fraud (he will need to check who to report this to in his country).

                    4. Check the email headers and black list the originator if possible.


                    Aside



                    If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email






                    share|improve this answer


























                    • Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...

                      – DaveP
                      Feb 5 at 9:16













                    • Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.

                      – Clinton
                      Feb 5 at 9:20













                    • @clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.

                      – davidgo
                      Feb 5 at 10:16











                    • Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.

                      – Clinton
                      Feb 5 at 11:40






                    • 1





                      @clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.

                      – davidgo
                      Feb 5 at 18:47
















                    0














                    This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.



                    However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.



                    The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).



                    Steps to take:




                    1. Contact the bank to stop any payments

                    2. Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).

                    3. Report the infringement / fraud (he will need to check who to report this to in his country).

                    4. Check the email headers and black list the originator if possible.


                    Aside



                    If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email






                    share|improve this answer


























                    • Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...

                      – DaveP
                      Feb 5 at 9:16













                    • Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.

                      – Clinton
                      Feb 5 at 9:20













                    • @clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.

                      – davidgo
                      Feb 5 at 10:16











                    • Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.

                      – Clinton
                      Feb 5 at 11:40






                    • 1





                      @clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.

                      – davidgo
                      Feb 5 at 18:47














                    0












                    0








                    0







                    This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.



                    However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.



                    The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).



                    Steps to take:




                    1. Contact the bank to stop any payments

                    2. Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).

                    3. Report the infringement / fraud (he will need to check who to report this to in his country).

                    4. Check the email headers and black list the originator if possible.


                    Aside



                    If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email






                    share|improve this answer















                    This is not an email that has been intercepted in transit. Emails are effectively inert, an email recipient can only be compromised if they click something in the email.



                    However, this looks like the recipient (your colleague) was socially engineered and then sent an email from someone trying to exploit his bank account. The attacker must have somehow known that your colleague expected to get an email from the company or that he was likely to pay into the account.



                    The recipient should check the details of where the email came from in the headers of the email. How best to do this depends on the email client used. However, headers can be forged so the 'from' may look legitimate. Check for IP addresses (see the aside below).



                    Steps to take:




                    1. Contact the bank to stop any payments

                    2. Contact the company who he expected the payment was from to advise them that their systems may have been compromised which led to his details being leaked (if applicable).

                    3. Report the infringement / fraud (he will need to check who to report this to in his country).

                    4. Check the email headers and black list the originator if possible.


                    Aside



                    If you want to trace the email address, this may help: https://whatismyipaddress.com/trace-email







                    share|improve this answer














                    share|improve this answer



                    share|improve this answer








                    edited Feb 5 at 9:16

























                    answered Feb 5 at 9:09









                    ClintonClinton

                    7171211




                    7171211













                    • Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...

                      – DaveP
                      Feb 5 at 9:16













                    • Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.

                      – Clinton
                      Feb 5 at 9:20













                    • @clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.

                      – davidgo
                      Feb 5 at 10:16











                    • Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.

                      – Clinton
                      Feb 5 at 11:40






                    • 1





                      @clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.

                      – davidgo
                      Feb 5 at 18:47



















                    • Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...

                      – DaveP
                      Feb 5 at 9:16













                    • Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.

                      – Clinton
                      Feb 5 at 9:20













                    • @clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.

                      – davidgo
                      Feb 5 at 10:16











                    • Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.

                      – Clinton
                      Feb 5 at 11:40






                    • 1





                      @clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.

                      – davidgo
                      Feb 5 at 18:47

















                    Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...

                    – DaveP
                    Feb 5 at 9:16







                    Well the company has a copy of the email that was sent. It has a different account number on it when compared to the email that is in my colleagues inbox. That's what's puzzling me. I couldn't see how it could be done without a compromised router or similar. These aren't big companies and it's not a large amount of money so it seems a lot of trouble to go to for a small reward...

                    – DaveP
                    Feb 5 at 9:16















                    Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.

                    – Clinton
                    Feb 5 at 9:20







                    Very strange. Thank you for the feedback. If you get to the bottom of this, please let me know. Still he should be concerned because whatever the scam, it could be applied to lots of people and does need to be stopped. We encourage scams by ignoring them.

                    – Clinton
                    Feb 5 at 9:20















                    @clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.

                    – davidgo
                    Feb 5 at 10:16





                    @clinton your answer is simply incorrect. Emails are not inert - as evidenced if you look at the full headers of any received email. (Also emails classified as possible spam often have the subject lines modified to reflect this) As an administratir I assure you that emails can be modified on-the-fly programatically. Its not trivial, but its not that hard either.

                    – davidgo
                    Feb 5 at 10:16













                    Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.

                    – Clinton
                    Feb 5 at 11:40





                    Thanks @davidgo for this feedback - something new every day. I am aware that an email account can be hacked of course, but have never heard of an email message being hijacked in transit. Cant find much online either. Will keep looking.

                    – Clinton
                    Feb 5 at 11:40




                    1




                    1





                    @clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.

                    – davidgo
                    Feb 5 at 18:47





                    @clinton - good on you for taking this onboard. postfix.org/SMTPD_PROXY_README.html shows one mechanism for doing this built into Postfix - a very commonly used SMTP server. Another way - As a typical mail provider my servers typically store email in plain text - 1 email per file. Were my server breached, an attacker could do a search and replace on the queued mail directory - as emails do not include a checksum , the received email would be accepted with precious little evidence of tampering. There are other ways to modify email via a MITM attack - easy if you can compromise DNS.

                    – davidgo
                    Feb 5 at 18:47


















                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Super User!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1402159%2fhave-contents-of-email-have-been-changed-in-transit%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Plaza Victoria

                    Puebla de Zaragoza

                    Musa