When Your Web Agency Disappears: A Founder's 48-Hour Technical & Legal Checklist

The WhatsApp message stays on a single grey tick

It starts with an uncharacteristic delay. A scheduled staging deployment does not happen on Friday afternoon. By Monday morning, your WhatsApp messages to the agency director remain on a single tick. Calls go straight to voicemail. An email to their support inbox bounces with a mail exchanger error, or simply hangs unanswered. Meanwhile, your production e-commerce checkout is running, or your corporate site is displaying an automated renewal notice from a shared hosting provider.

The standard executive reaction is panic followed by confrontation: threatening police reports, firing off public LinkedIn warnings, or demanding immediate handovers. That emotional escalation is almost always counter-productive in the first 48 hours. If an agency or disgruntled freelancer holds your DNS master keys, domain registrar credentials, or root server passwords, an antagonistic confrontation before securing your technical perimeter can prompt retaliatory destruction, database wiping, or spiteful lockouts.

Your immediate objective is asset preservation and boundary containment. Here is the operational, technical, and legal sequence Malaysian company directors must execute within the first 48 hours of an agency going dark.

Hours 0–6: Map the perimeter across three separate layers

Most non-technical founders mistakenly speak of "the website" as a single object. In reality, your digital estate consists of three distinct commercial and legal layers, often hosted with completely different providers. You must identify where each layer resides before touching a single configuration file.

1. The Domain Registrar (The Legal Root)

The registrar controls who owns your web address. For Malaysian businesses, this is either MYNIC directly (for .my and .com.my domains) or an ICANN-accredited registrar such as Exabytes, Shinjiru, Namecheap, or GoDaddy (for .com, .io, or .org).

• Run a public WHOIS lookup via your terminal or a web client (whois yourcompany.com.my).
• Identify the Registrant Organization and the Administrative Contact.
• If the Registrant is listed as your Sdn Bhd name with your official SSM company registration number, you hold ultimate legal authority, even if the billing contact belongs to the missing agency.
• If the agency registered your domain under their own private name or agency SSM number, you are facing an urgent ownership dispute rather than a simple password reset.

2. The DNS Authority (The Traffic Director)

Domain Name System (DNS) records translate your domain name into server IP addresses and route corporate emails to Google Workspace or Microsoft 365.

• Run dig NS yourcompany.com.my +short in terminal to see where nameservers point.
• Common configurations in Malaysia point to Cloudflare (*.ns.cloudflare.com), Exabytes (*.mschosting.com), or cPanel DNS.
• Whoever controls the active nameservers can redirect your customer traffic, cut off incoming corporate emails, or issue new SSL certificates within minutes.

3. The Production Server & Database (The Assets)

Where the actual application files, customer records, and databases execute.

• Check recent invoices to see who billed you for hosting. Is it an AWS account in Singapore (ap-southeast-1), a VPS on Shinjiru or ServerFreak, or a cPanel reseller pool managed by the agency?

Hours 6–18: Secure read access and pull cold forensic snapshots

If you still possess administrative logins to cPanel, an SSH key, or a WordPress/CMS super-administrator account, do not immediately revoke the agency's credentials. Revoking their access triggers automated notification emails that announce your takeover. Instead, silently extract a complete, cold forensic backup of the entire estate.

Run a complete database dump and compress the web application assets immediately:

# 1. Export database with routines, triggers, and single-transaction lock
mysqldump -u db_user -p --single-transaction --quick --routines --triggers database_name > production_backup_$(date +%F).sql

# 2. Archive all application source files, including hidden configuration dotfiles
tar -czvf webroot_backup_$(date +%F).tar.gz -C /home/username/public_html .

# 3. Secure environmental secrets and server configuration
cp /home/username/public_html/.env ./env_backup_$(date +%F).txt

If your site is hosted on a managed WordPress environment or cPanel without shell access:

1. Navigate to cPanel > Backup Wizard and download a Full Account Backup to your local drive.
2. Open phpMyAdmin, select your WordPress database, click Export, and select the Quick - display minimal options method with SQL format.
3. Download your wp-config.php or application configuration files via File Manager. These contain database passwords, API secret keys, and salt hashes.
4. Clone Git repositories: Check wp-content or the root directory for a .git directory. If a remote repository exists, run git config --get remote.origin.url to find the GitHub, GitLab, or Bitbucket repository housing your software's version history.

Store two separate copies of these archives: one on a local encrypted drive and one in a secure cloud bucket (such as AWS S3 or a company-controlled Google Drive) that is completely disconnected from the agency.

Hours 18–30: Reclaim registrar and DNS sovereign control

Once an immutable copy of your data is secured offsite, move to isolate access at the domain and DNS layers.

For .my and .com.my domains registered via MYNIC

Under MYNIC registry regulations, the corporate entity listed under the SSM registration is the indisputable owner of the domain. If the agency registered the domain on their reseller account or under a missing administrator email:

1. Access the MYNIC Selfcare portal (selfcare.ichoose.my).
2. If credentials fail, prepare an official MYNIC Administrative Contact Update Request.
3. Compile the statutory documents: a formal application letter printed on company letterhead signed by a director, a copy of the director's MyKad (front and back), and an updated SSM e-Info Corporate Profile (SSM Section 14 / Section 17 Corporate Profile).
4. Submit the package directly to MYNIC support (customercare@mynic.my). MYNIC is the statutory .my registry, operating under the Ministry of Digital with MCMC oversight. MYNIC does not publish a guaranteed turnaround time for administrative-contact changes, but a director submitting complete, valid SSM documentation should expect the request to be processed in days rather than months (MYNIC domain name lifecycle overview).

Securing DNS via Cloudflare

If DNS is trapped inside the agency's private Cloudflare organization:

1. Create a brand-new, company-owned Cloudflare account using a secure company distribution email (infrastructure@yourcompany.com.my).
2. Add your domain to the new account. Cloudflare will automatically scan and clone existing public DNS records (A, CNAME, MX, TXT/SPF).
3. Verify every individual record against your live mail server settings (Google Workspace MX, Microsoft 365, Mailgun, or SendGrid DKIM keys).
4. Update the authoritative nameservers at your domain registrar to point to your new Cloudflare nameservers. Once saved, the agency can no longer alter your DNS routing or intercept company communications.

Hours 30–48: Legal evidence preservation under Malaysian law

When an agency abandons an ongoing project or withholds deliverables after receiving progress payments, commercial disputes often end in litigation, arbitration, or formal mediation. The Malaysian Evidence Act 1950 (specifically Section 90A, added in 1993 to cover computer-produced documents) governs how digital evidence must be preserved to remain admissible in court (Evidence Act 1950, Act 56).

Do not delete communications or modify server logs:

• WhatsApp and Messaging Chains: Do not rely on casual mobile phone screenshots. Export full WhatsApp chat transcripts with media included. Note down the specific phone numbers, timestamps, and payment acknowledgments.
• Financial Trails: Retrieve official bank confirmation slips from Maybank2u, CIMB BizChannel, or RHB Reflex. Cross-reference transaction IDs with the agency's issued commercial invoices, looking specifically for matching SSM registration numbers and bank account names.
• The Contractual Copyright Presumption: Under Section 26(2) of the Malaysian Copyright Act 1987, when a work is commissioned by a person who is not the author's employer under a contract of service, the copyright is deemed transferred to the person who commissioned the work, subject to any agreement to the contrary (Copyright Act 1987, Act 332). If your agreement stipulates that IP transfers upon milestone payment, and payment is verified, the agency has no legal right to withhold code or deploy malicious lockouts — though this is a presumption a court applies, not a guarantee that avoids a dispute; keep the payment and milestone records that let you rely on it.
• Formal Notice of Demand: Instruct your corporate legal counsel to issue a formal Letter of Demand (LOD) via registered post and email to the agency's SSM registered office address. The letter should specify a strict 72-hour window for complete credential surrender, technical repository access, and formal assignment of intellectual property.

Moving from recovery to permanent stability

Agencies vanish for mundane reasons: cash flow collapse, founder disputes, sudden loss of key technical personnel, or plain negligence. What turns an agency failure into a corporate catastrophe is the failure of the client to maintain independent ownership of their digital infrastructure.

At JagaWeb, we regularly carry out forensic investigations for Malaysian enterprises dealing with abandoned or disputed platforms:

• Ownership & Access Review (RM1,500 fixed): A comprehensive forensic audit across eight critical infrastructure control points. We locate your domain handles, trace your hosting perimeter, identify stranded third-party APIs, and produce an executive-ready action plan. The full RM1,500 fee is credited dollar-for-dollar against eligible follow-on engineering work within 12 months.
• JagaWeb Care (RM450/month): Our managed website care plan. We ensure your production website runs on infrastructure you own outright, backed by daily offsite backups with tested restore on your own hosting platform, 24/7 uptime monitoring and incident response, and ongoing security patching.
• Fixed-Scope Project (from RM30,000): If an abandoned codebase is corrupted or unmaintainable, we rebuild it as a clean, modern, high-speed architecture on Next.js or a headless framework, under a written scope and acceptance criteria, with intellectual property ownership in your company's name from day one.

You do not need to negotiate from a position of vulnerability. Secure your snapshots, lock down your domain at the registry level, and build your digital estate on foundations you control.