German police have ruled out blackmail as the reason why two bombs were left on trains on 31 July - and now believe it was a failed terror attack.
Police are still trying to work out why the devices did not explode
The bombs were in identical black cases on trains in Dortmund and Koblenz.
They had been timed to explode 10 minutes before the trains arrived, said federal crime chief Joerg Ziercke.
"We are now working on the basis that this was the work of a terrorist group... and was an attempt to kill a large number of people," he said.
Police want to trace two men seen on CCTV wheeling cases at Cologne station.
Initial suggestions that the bombs may have been an attempt to blackmail a train company had been ruled out, Mr Ziercke said.
He said police were working on the theory that the group responsible were based in Germany.
The Arabic note found with one of the bombs lists grocery items
The devices consisted of gas canisters, alarm clocks, wires, batteries and a flammable liquid in soft drink bottles.
A handwritten note in Arabic, listing groceries, a telephone number in Lebanon and packets of starch labelled in Arabic and English, were also found.
Mr Ziercke said up to 100 investigators were trying to work out why the devices failed to detonate. "We still have many unanswered questions," he said.
He appealed to the public for help in tracking down the people who planted the device.