What kind of person would DDoS a video player website?
That's my general assumption of any attack in which the response to a request is in the many MB range and the request is in the bytes range.
That someone with limited bandwidth and many connections is attempting to acquire a large amount of bandwidth to attack someone else.
> The actual number of requests was not that high (400 req/s), but the botnet was downloading the whole vlc.exe, aka 22MB. So, we were at around 70Gbps during the night, in average.
Source spoofing would not allow downloading the whole file; the spoofed source address would get the first response packet and send an RST ("stop, no connection associated with this packet, go away") long before that point.