As mentioned in the earlier the group indeed is quick to changing their active scam site to trick more users into purchasing their rogue security application.
The new scam site used by the group:
Site Name: XPAntivirussecurity.com
IP Address: 126.96.36.199
VirusTotal Scan Result: 1/32 (3.12%)
F-Prot 188.8.131.52 2008.03.30 W32/Downloader.F.gen!Eldorado
Other sites used by this group:
Both these sites share the same IP address 184.108.40.206
Stay away from these sites.
Bharath M N