An intentional DOS attack is, as you point out, often launched from a bunch of zombies. But the client-server relationship is fragile and prone to misunderstanding :-)

Worst-case scenario, imho, is that the remote server is running a MySQL DB and PHP (especially if the former is poorly-designed and the latter unoptimized). Yeah, I'm sure those tools are getting better with age, and my bias was formed years ago after watching many, many servers (running the aforementioned dynamic duo) go down for the count.

Anyway, I think alcaray's point is a good one...you can likely send requests much faster than the server can respond, especially if database access is required on the remote end, which is likely. Your machine, unrestrained, could very well pummel either the web server, or the database server, or both to within an inch of their lives.

There are lots of variables, of course, but it's usually best to play it safe and take things slow. Just an opinion.