Sri Lankan security officials have warned that Islamist terrorists behind Easter Sunday's suicide bombings are planning imminent attacks and could be dressed in military uniforms.
The terrorists were targeting five locations for attacks on Sunday or Monday, security sources said.
"There could be another wave of attacks," the head of ministerial security division (MSD), a unit of the police, said in a letter to lawmakers and other officials, seen by Reuters on Monday.
"The relevant information further notes that persons dressed in military uniforms and using a van could be involved in the attacks."
There were no attacks on Sunday, and security across Sri Lanka has been ramped up, with scores of suspected Islamists arrested since the April 21 attacks on hotels and churches that killed more than 250 people, including 40 foreign nationals.
Two cabinet ministers and two opposition lawmakers confirmed to news agency Reuters that they were aware of the latest security alert.
"We have been informed about this by the MSD," Health Minister Rajitha Senaratne said.
The government has also banned women from wearing face veils under an emergency law that was put in place after the attacks.
There were concerns within the Muslim community that the ban could fuel tensions in the multi-ethnic nation. But government officials said it would help security forces identify people as a hunt for any remaining attackers and their support network continues across the Indian Ocean island, which was gripped by civil war for decades until 2009.
Authorities suspect members of two little known groups - National Thawheedh Jamaath (NTJ) and Jammiyathul Millathu Ibrahim - of carrying out the Easter attacks, though Islamic State has claimed responsibility.
Prime Minister Ranil Wickremesinghe said a tight-knit group of people was involved, mostly close friends and families. They spoke face-to-face, possibly to evade electronic surveillance.
"They (the group) were small enough that they were not using normal communications, instead meeting each other," Wickremesinghe told Reuters.
He added the coordinated bombings, the type of explosives used and the tightly guarded plot suggested the bombers had guidance.
"ISIS (Islamic State) has claimed, we also felt there has to be some international links," he said.
Row over police chief
Many Sri Lankans believe a deep rift between President Maithripala Sirisena and Wickremesinghe has also undermined national security.
Sirisena fired Wickremesinghe last year, after months of tension, only to be forced to reinstate him under pressure from the Supreme Court.
Since then their relationship has deteriorated further to the point where their factions actively try to undermine each other, including not sharing security information, defence sources say.
Sirisena said on Monday he had appointed Chandana Wickramaratne, the second in command at the police, as acting police chief.
Over the weekend, two sources at the president's office told news agency Reuters that Pujith Jayasundara, the police chief who was appointed by Wickremesinghe, was refusing the president's request to step down for not sharing information about the attacks.
"Since there is an investigation into his possible failure in preventing the attacks, Jayasundara has been sent on compulsory leave," a source close to the president told Reuters.
It was not immediately possible to contact Jayasundara on Monday.
In India, police said they had raided the homes of three people in Kerala, close to Sri Lanka, in connection with their links to Islamic State. They did not say if there was any connection to the attacks in Sri Lanka.