I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 126.96.36.199 for Domain A, and 188.8.131.52 for Domain B.
Each domain has a different system that will communicate with the other using API. I'm wondering what would be the risks if I didn't use SSL/TLS connection for the API calls?
If I restricted access to API calls to 127.0.0.1 and the above IPs only, will it be still possible for an attacker to hijack transmitted information? Can he spoof the IP to appear using the server's IP and then steal the information?