Cybersecurity experts say 16 sites, using same phrasing, logos, and sometimes web infrastructure, were likely part of Iran-backed counterintelligence operation