In which of the following scanning methods does an attacker send the spoofed IP address to send a SYN packet to the target?

In an IDLE scan, the attacker identifies a zombie host with a predictable incremental IP ID sequence, then spoofs the zombie's IP address when sending SYN packets to the target. The attacker infers whether target ports are open or closed by monitoring changes in the zombie's IP ID counter, completely concealing the attacker's real IP address from the target host.

A TCP FIN scan sends a FIN packet directly to a target port to elicit an RST response from closed ports; it does not involve IP spoofing or a zombie host.

A NULL scan sends a packet with no TCP flags set to infer port state based on the target's response; it does not use a spoofed IP address or intermediate zombie host.

An XMAS scan sends a packet with FIN, PSH, and URG flags simultaneously to probe port state; it does not involve spoofing an IP address through a zombie host.