All day people were coming in and out of the house with the pale-pink walls, and neighbours were becoming suspicious. An elder in the village of the eastern Sri Lankan city of Kalmunai was summoned to confront the men who had rented the property a few weeks before.

The discussion soon became tense, and a tall, well-built man whom the elder did not recognise walked out of the house carrying an automatic weapon. “You have no business being here,” he said, according to the elder, firing a few rounds into the air and sending neighbours fleeing.

By the early hours of Saturday, 15 people were dead, including three children, and the walls of the house were blackened by the force of three explosions from the suicide bombers who had been cornered inside.

Reuters reported on Saturday that a woman and child injured in the fighting were the wife and daughter of Mohammed Zahran Hashim, the extremist preacher identified as the leader of the terrorist cell responsible for killing at least 253 people in a string of bombings of churches and luxury hotels. Police sources said the woman was in a serious condition.

The 90-minute gun battle in the city, about seven hours’ drive from the Sri Lankan capital, Colombo, is part of an ongoing hunt for accomplices and sympathisers of the suicide bombers that has led to dozens of arrests and controlled explosions of suspicious vehicles and packages.

Sri Lankan leaders have estimated there are at least 70 people still at large, “some capable of exploding themselves”, the country’s prime minister, Ranil Wickremesinghe, told the Observer. Both the US and India stepped up their travel warnings for nationals seeking to visit Sri Lanka on Saturday.

The house in Kalmunai had been rented by a man claiming to be a telecommunications engineer, the landlord, who asked not to be named, said. He had paid cash, but unusually, had not asked for a discount for doing so. Money had not appeared to be a problem.

On Friday night a civilian was killed in the crossfire between police and the men inside and at least three others were injured, police said.

Sri Lanka bombings: everything we know so far Read more

On Saturday afternoon, a video started to be shared on Islamic State’s online channels purporting to show three men inside the house. “Those who try to destroy us will be a taught a lesson,” says one man, who appears to have just one eye and several mangled fingers. Children can be heard in the background.

The next man speaks holding a rifle in one hand and his toddler son in the other. “Those who wish to do us harm are surround us now,” he says. “Even if we are destroyed this movement will not be stopped.” It is not clear when the video was shot and its authenticity has not been verified.

Since Sunday’s attack by the radical network, led by Hashim, a previously obscure radical preacher, police are re-examining a series of incidents that they now view as possible red flags that militants in the country were becoming more violent and brazen.

Authorities are now actively investigating whether the murder of two policemen last year at a remote police checkpoint in Vavunathivu, a town in the eastern district of Batticaloa, was also committed by members of the network, sources inside the investigation revealed on Saturday. A gun thought to belong to one of the murdered officers was found inside the house that was raided in Kalmunai on Friday night, sources said. At the time, the murder was suspected to be the work of remnants of the Tamil Tigers.

The vandalism of four Buddhist statues in Mawanella, a central town, about a month after the shooting of the officers is also being seen a crucial change in tactics: the first time men linked to Hashim turned their ire on people of another faith, after years of harassing other Muslims.

“This may have been a tryout,” Wickremesinghe said. “We know that before the Buddhist images there were attacks on Sufi mosques. So they appeared to be going step by step. First their own Muslims, then the Buddhists, and there was something in a small church near Kandy, information that they wanted to damage the church.”

Facebook Twitter Pinterest Sri Lankan security personnel search a vehicle in Colombo. Photograph: Carl Court/Getty Images

Authorities received multiple warnings about Zahran from Muslim community leaders and specific intelligence in the weeks, days and possibly hours before the 21 April attacks that the extremist was planning to target churches.

Why those warnings were ignored has been the subject of recriminations this week inside Sri Lanka’s bitterly divided government.

“There was a communications breakdown because nothing was being shared with me and the prime minister,” said Ruwan Wijewardene, Sri Lanka’s defence minister, who had been excluded from security council meetings since a constitutional crisis cleaved the government into factions last October.

The country’s president, Maithripala Sirisena, who chairs the security council meetings, says he was never told of the threat either. Blame has fallen on the country’s top defence bureaucrat, Hemasiri Fernando, and the chief inspector of police Pujith Jayasundara.

Fernando quit on Thursday evening after submitting a defiant resignation letter. “I have disseminated the information I received and carried out my responsibility, however, certain officials and relevant departments have not acted accordingly, and as a result we had to face this terrible tragedy,” he wrote.

Facebook Twitter Pinterest A Sri Lankan soldier stands guard on a street in Colombo. Photograph: Jewel Samad/AFP/Getty Images

In past months, Sirisena has been deploying the resources of the country’s security apparatus towards a war on drugs inspired by the brutal campaign of the Philippines president, Rodrigo Duterte. A vast network of military and intelligence officials are also spread out through the country’s north, keeping watch on Tamil civilians the embers of the Tamil Tigers militia.

“Drugs have always been an issue to us, but we also had to be on our guard against terrorism, global terrorism,” Wickremesinghe said. “Some people were looking really at the re-emergence of the [Tigers] but I couldn’t see that.”

Late on Saturday, Sirisena announced he was banning two groups allegedly linked to the Easter bombings under emergency powers that came into effect on Tuesday. His office said National Thawheed Jammath, or NTJ, and Jamathei Millathu Ibraheem, or JMI, would be banned by presidential decree.

Presidential spokesman Dharmasri Ekanayake said the move allowed the government to confiscate any property belonging to the two organisations.

The one-week mark since the devastating attack will be quietly honoured, with churches advised not to hold Sunday masses. A small service will be led by Cardinal Malcolm Ranjith in Colombo, and broadcast on national television. “His eminence [the cardinal] has advised us not to gather people in churches,” said a spokesman. “In place of that, his eminence is expecting the faithful to watch the mass in spirit.”

Another service is scheduled to be held in a tent outside St Sebastian’s church in Negombo, where last week, a bomber with a backpack entered the middle of the church towards the end of the service, turned his back to the congregation, and detonated himself. More than 100 people were killed there.