Also note to those of you who are using Wordfence, they're currently scanning files for the 203koko URL and reporting it as a threat. However caching plugins like WTC will cache blogrolls and Dashboard news feeds. This article was features in the news feed and contains the 203koko URL in the body. This content is being cached to flatfiles which are scanned by Wordfence. Such cases are false positives.