Sri Lankan security officials have warned that Islamist militants behind Easter Sunday's suicide bombings are planning imminent attacks and could be dressed in military uniforms.

The militants were targeting five locations for attacks on Sunday or Monday, security sources said.

"There could be another wave of attacks," the head of ministerial security division (MSD), a unit of the police, said in a letter to lawmakers and other officials, seen by Reuters on Monday.

"The relevant information further notes that persons dressed in military uniforms and using a van could be involved in the attacks."

There were no attacks on Sunday, and security across Sri Lanka has been ramped up, with scores of suspected Islamists arrested since the April 21 attacks on hotels and churches that killed more than 250 people, including 40 foreign nationals.

Two cabinet ministers and two opposition lawmakers confirmed to Reuters that they were aware of the latest security alert.

"We have been informed about this by the MSD," Health Minister Rajitha Senaratne said.

Authorities suspect members of two little known groups - National Thawheedh Jamaath (NTJ) and Jammiyathul Millathu Ibrahim - of carrying out the Easter attacks, though Islamic State has claimed responsibility.

Prime Minister Ranil Wickremesinghe said a tight-knit group of people were involved, mostly close friends and families. They mostly spoke face-to-face, possibly to evade electronic surveillance.

"They (the group) were small enough that they were not using normal communications, instead meeting each other," Wickremesinghe told Reuters.

He added the coordinated bombings, the type of explosives used and the tightly guarded plot suggested the bombers had guidance.

"ISIS (Islamic State) has claimed, we also felt there has to be some international links," he said.

President Maithripala Sirisena said on Monday he had appointed Chandana Wickramaratne, the second in command at the police, as acting police chief.

Over the weekend, two sources at the president's office told Reuters that Pujith Jayasundara, the police chief during the attacks, was refusing the president's request to step down.

It was not immediately possible to contact Jayasundara on Monday.

In India, police said they had raided the homes of three people in the southern state of Kerala, close to Sri Lanka, in connection with their links to Islamic State. They did not say if there was any connection to the attacks in Sri Lanka.