I would go for something like A - B - A:

• hide the links so the ddos gets migitated, and start replacing the links where possible
• when the malicious code is gone, reinstate the links, deprecate .today, dont stop replacing the links
• when the links in the most commonly requested articles are gone, hide the rest while it waits for replacement.

but i’m no wikipedian, just someone who likes reading talk pages lol