A computing device, executing a decoy application server that does not have access to real data, receives a service request from a client. The decoy application server protects a designated application server, wherein the decoy application server and the designated application server include instances of a single Java application server program. The decoy application server establishes a connection to a false database via a decoy Java Database Connectivity (JDBC) driver. The decoy application server retrieves false data from the false database, and provides the false data to the client.