atomizer on "very alarmed - possible site compromise?"

this URL does not exist on my site - i did not write this content:

http://12bytes.org/old-mappila-pattukal-mp3-free-download.php

i'm the sole admin and registration is disabled

in the source code for this URL, i see this meta-tag...

<meta name="google-site-verification" content="cy7tEN6K8aVjFPd66GkkxXn0h59CRXUYJJy1lKmK7q8" />

but that doesn't explain what is generating the content

Remain calm and carefully follow this guide. When you're done, you may want to implement some (if not all) of the recommended security measures.

And don't forget check your site here:
https://sitecheck.sucuri.net//

scans are coming up clean and i'm not seeing any rogue files

these urls (and there are tons of them) seem to be dynamically generated

my host uses a cache mechanism for Nginx which can be bypassed my adding ?nocache=1 to the end of a URL - if i add that param, these pages come up blank

something very strange going on but not sure what it is

i opened a ticket with my host to see if it's a server-wide issue, but would vey much appreciate any info anyone here could provide also