As mentioned in the earlier the group indeed is quick to changing their active scam site to trick more users into purchasing their rogue security application.
The new scam site used by the group:
Site Name: XPAntivirussecurity.com
IP Address: 22.214.171.124
VirusTotal Scan Result: 1/32 (3.12%)
F-Prot 126.96.36.199 2008.03.30 W32/Downloader.F.gen!Eldorado
Other sites used by this group:
Both these sites share the same IP address 188.8.131.52
Stay away from these sites.
Bharath M N