The suicide attacker who detonated a bomb that killed 10 German tourists in the heart of Istanbul’s historic district had registered as a refugee just a week earlier, Turkish officials say.

Turkish authorities identified the assailant in Tuesday’s attack as a Syrian man who was born in 1988, and said he was affiliated with the Islamic State group.

Turkish media, including some close to the government, identified him as Nabil Fadli and said he was Saudi-born. The extremist group has not so far claimed the attack.

• Explosion in Istanbul; 10 foreigners killed in blast
• Five injured in Istanbul explosion
• Leftists take hostage in Istanbul court

Meanwhile, Turkish police arrested five people suspected of direct links to the bomb attack which took place just steps from the historic Blue Mosque in Istanbul’s storied Sultanahmet district. The suspects were not identified.

The bomber had recently entered Turkey, authorities said, and Interior Minister Efkan Ala confirmed reports he had registered with an Istanbul branch of the Migration Management Authority, providing fingerprints that allowed officials to quickly identify him.

Ala said the bomber wasn’t on any Turkish or international watch lists for IS militants.

“This person was not someone who was being monitored,” Prime Minister Ahmet Davutoglu said on Wednesday.

“It is a person who entered normally, as a refugee, as an asylum-seeker.”

The attack wounded 15 people, including nine Germans and citizens of Norway, Peru and South Korea. Six of the victims remained hospitalised on Wednesday.

Citizens leave carnations as they gather near the site of the explosion in the historic Sultanahmet district in Istanbul. Photo: AP

Tuesday’s bombing had heightened resonance because it struck at Turkey’s $US30 billion ($A43.08 billion) tourism industry, which has already suffered from a steep decline in Russian visitors since Turkey shot down a Russian warplane near the Syrian border in November.

The fact that the bomber had registered as a Syrian refugee suggests central planning by IS leaders, to cover their tracks or provoke a backlash in Europe against legitimate Syrian asylum-seekers, said Firas Abi-Ali, an analyst with the security consultancy IHS Country Risk.

“It seems to make it less likely this was anything but a centrally commanded operation by the Islamic State,” he said.

It is not the first time the group has taken advantage of the chaos caused by the huge influx of asylum-seekers into Europe by ensuring that suicide bombers were registered and fingerprinted – and would thus be identified as refugees after their deaths.

Two of the suicide bombers who died on November 13 at France’s national stadium had registered in Greece – and their forged Syrian passports were found on their bodies.

In addition to the five people suspected of direct links to Tuesday’s attack, more than a dozen other suspected IS militants were detained on Wednesday and 59 a day earlier, although none appeared to be tied to the Istanbul bombing.

They included three Russian nationals taken into custody in the Mediterranean coastal city of Antalya. The state-run Anadolu Agency said the suspects were allegedly in contact with IS fighters in conflict zones and had provided logistical support to the group.