Skip to main content
ThreatPhishing & impersonation

Fake Strava / Zwift / AllTrails+ fitness training app subscription payment failed, segment data at risk, or training access suspended phishing — fraudulent email impersonating Strava, Zwift, or AllTrails claiming the recipient's subscription payment has failed, their segment leaderboard access is suspended, their training data and performance history are at risk, or their cycling routes are unavailable — directing them to update billing or restore access through a credential-harvesting portal; Strava: 80M+ users, 10M+ paid subscribers ($11.99/month); Zwift: 1M+ subscribers ($14.99/month); AllTrails: 4M+ paid subscribers ($35.99/year); athlete identity investment in training data makes "your segment history and performance records are at risk" a powerful urgency trigger

fake-strava-zwift-fitness-training-app-subscription-phish

What this tier means

High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.

How Gorganizer detects this

Phishing emails impersonating Strava, Zwift, or AllTrails claiming the recipient's fitness training subscription payment has failed, their segment leaderboard access is suspended, their training data and performance history are at risk, or their cycling routes are unavailable — directing them to update billing, restore access, or protect training history through a credential-harvesting portal. Key facts: (1) Strava's athlete identity investment makes training data loss uniquely threatening: 80M+ Strava users with 10M+ paid subscribers ($11.99/month) have built their fitness identity around Strava's activity feed, segment competition, and performance records; multi-year training logs, KOM/QOM segment records, course PRs, and achievement streaks represent real athletic accomplishment data the user cares deeply about protecting; 'your Strava subscription is suspended and your segment history and performance data are at risk' exploits this athletic identity investment to bypass phishing skepticism; (2) Strava's segment leaderboard mechanic creates competitive urgency distinct from other streaming services: active Strava users check segment rankings frequently and compete with local athletes; a subscription suspension means losing the ability to compete for KOM/QOM placings and to view the leaderboards that drive the community engagement loop; this is an acute social and competitive disruption, not just content access loss; (3) Zwift (1M+ subscribers, $14.99/month) represents a unique attack surface where real cycling hardware is involved: Zwift users connect expensive cycling equipment ($500-3,000+ smart trainers, power meters, heart rate monitors) to the Zwift platform; 'your Zwift subscription has been suspended and your training routes are unavailable' threatens planned cycling workouts with connected hardware ready to ride; a Zwift subscription suspension leaves expensive gear sitting unused, creating both financial and training-disruption urgency; (4) AllTrails+ (4M+ paid subscribers, $35.99/year) stores personal route completion records, life lists, trail reviews, and offline downloaded maps for backcountry hikes — 'your AllTrails Plus offline maps and route planning are suspended' creates wilderness-safety anxiety for hikers who rely on downloaded maps in areas without cell service; (5) TrainingPeaks ($19.99/month Premium) and Wahoo SYSTM (formerly TrainerRoad equivalent) are used by coached athletes and triathletes who schedule training blocks months in advance. Warning signs: sender domain not strava.com, zwift.com, alltrails.com, or trainingpeaks.com; Strava only contacts subscribers from strava.com; any subscription issue should be managed in the app.

False-positive guard

Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.

About the scoring engine

Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.

Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.

Ready to clean your inbox?

Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.

Get started