The same flood of traffic as a denial-of-service attack, but sent from thousands of hijacked devices at once.
Like a thousand prank callers phoning the same shop at the same moment, so blocking one number does nothing.
Should I pay if someone threatens to take my site down?
Do not pay. Tell your hosting provider, keep the message, and have the traffic filtered.
Every WILDCARD card exists to solve one named problem. Find yours.