Attacks can originate from multicast receivers. Any receiver that sends an IGMP or MLD
report typically creates state on which router?

A.
customer

B.
first-hop

C.
source

D.
RP

Explanation:
Attacks can originate from multicast receivers. Any receiver sending an IGMP/MLD
report will typically create state on the first-hop router. There is no equivalent
mechanism in unicast.

http://www.cisco.com/web/about/security/intelligence/multicast_toolkit.html