As mentioned in the earlier the group indeed is quick to changing their active scam site to trick more users into purchasing their rogue security application.
The new scam site used by the group:
Site Name: XPAntivirussecurity.com
IP Address: 220.127.116.11
VirusTotal Scan Result: 1/32 (3.12%)
F-Prot 18.104.22.168 2008.03.30 W32/Downloader.F.gen!Eldorado
Other sites used by this group:
Both these sites share the same IP address 22.214.171.124
Stay away from these sites.
Bharath M N