I purchased a domain from someone here and they pushed it to me at Rebel.com. I cancelled my Paypal agreement with Rebel.com in case they tried to charge me for something I did not agree to, and sure enough they immediately tried to charge me $40 for a new year on the domain, even thought the settings on the domain did not even have auto-renew on. I got an e-mail from them that said something like, "Pay this $40 or you will lose your domain." I do not owe them $40. I never requested a new year. There have been no changes to the WHOIS info (it is the same as before). I decided I wanted to transfer away from these scammers and I requested an auth code, and the system told me there was an error and to contact support. I believe they are going to try to steal my domain. I don't see how a simple push means I owe them $40. Do I have any legal recourse apart from actually hiring a lawyer?