As mentioned in the earlier the group indeed is quick to changing their active scam site to trick more users into purchasing their rogue security application.
The new scam site used by the group:
Site Name: XPAntivirussecurity.com
IP Address: 184.108.40.206
VirusTotal Scan Result: 1/32 (3.12%)
F-Prot 220.127.116.11 2008.03.30 W32/Downloader.F.gen!Eldorado
Other sites used by this group:
Both these sites share the same IP address 18.104.22.168
Stay away from these sites.
Bharath M N