In which of the following malicious hacking steps does email tracking come under?

Maintaining access refers to the phase where an attacker who has already compromised a system installs backdoors or rootkits to retain persistent entry.

Gaining access is the phase where the attacker actively exploits vulnerabilities to breach the target system, which requires prior reconnaissance to have been completed.

Reconnaissance is the initial hacking phase focused on passively or actively gathering information about a target before any attack is launched. Email tracking - monitoring whether an email was opened, from what IP, and when - is a classic passive reconnaissance technique used to profile targets. No system access is attempted during this phase; it is purely about intelligence collection.

Scanning involves actively probing the target network using tools like port scanners and vulnerability scanners after initial reconnaissance data has been gathered.