As mentioned in the earlier the group indeed is quick to changing their active scam site to trick more users into purchasing their rogue security application.
The new scam site used by the group:
Site Name: XPAntivirussecurity.com
IP Address: 18.104.22.168
VirusTotal Scan Result: 1/32 (3.12%)
F-Prot 22.214.171.124 2008.03.30 W32/Downloader.F.gen!Eldorado
Other sites used by this group:
Both these sites share the same IP address 126.96.36.199
Stay away from these sites.
Bharath M N