The RECONNAISSANCE phase of the Cyber Kill Chain involves gathering information about the target before launching an attack. This includes identifying targets, footprinting, and gathering intelligence about the network and systems. Discovering internet-facing servers is an activity that fits perfectly into this phase, as it involves collecting information about potential entry points and vulnerabilities in the target's network. Installing backdoors, emailing with malware, and loading malicious payloads are activities that fall under subsequent phases like exploitation, delivery, and installation, rather than reconnaissance.