Two men have been arrested in Germany on suspicion of planning an attack on a shopping centre in Oberhausen near the Dutch border, police say.
The brothers, aged 31 and 28 and born in Kosovo, were detained early on Friday in Duisburg.
Germany is on high alert after Monday's attack in Berlin, which left 12 dead.
A Europe-wide manhunt continues for Anis Amri, the Tunisian man suspected of driving a lorry into the Breitscheidplatz Christmas market.
Police said the Oberhausen attack had been intended to target the CentrO shopping centre.
Officers dressed in civilian clothing had been sent to patrol the centre and a nearby Christmas market after a tip from intelligence services, police said in a statement.
It is not yet known how advanced the preparations for the attack were, or if others were involved, the statement said.
There is no indication so far that Friday's arrests are linked to the Berlin attack.
German officials have confirmed Anis Amri's fingerprints were found inside the truck that was used to kill 12 people and wound 49 others in the capital on Monday evening.
His family in Tunisia have urged him to give himself up to police.
Breitscheidplatz market in Berlin reopened on Thursday, with dimmed lights and no music.
Candles and flowers have been laid for the victims, who include at least six Germans, an Israeli tourist, an Italian woman and the truck's Polish driver. Police have installed concrete barriers to prevent a repeat attack.
"If my brother is listening to me, I want to tell him to surrender, even for our family. We will be relieved," Abdelkader Amri told reporters from the family home in Tunisia.
"If he did what he is suspected of having done, he will be sanctioned," he went on.
But he added: "I am sure that my brother is innocent. I know why he left home: he left for economic reasons... to work, to help the family, he didn't go for [terrorism] reasons."
Both Abdelkader, and another brother, Walid, admitted that Anis had got into trouble in Europe and came out of a three-and-a-half year jail term in Italy with a "totally different mentality".
But Walid said he had spoken to Anis just 10 days ago, and he had said he hoped to return to Tunisia in January.
"He was saving money so he could come here, and buy a car and start a business. That was his dream."
The German federal prosecutor's office said Amri's fingerprints had been found in a number of places around the lorry's cab.
"At this point in the investigation, we assume Anis Amri drove the truck," spokeswoman Frauke Koehler said.
She also confirmed police raids had been carried out "in various locations" in Berlin and in North Rhine-Westphalia state where the suspect "was living and staying for some time".
Chancellor Angela Merkel earlier said she was hopeful for a quick arrest, and said she was very proud of how calmly most people in Germany had reacted to the attack.
Amri was named as a suspect on Wednesday after his identification papers were found in the truck.
A Europe-wide arrest warrant has been issued amid warnings he may be armed and dangerous. The German authorities have offered a reward of up to €100,000 for information leading to his arrest.
There is growing criticism of Germany's security services as details emerge about Amri and his alleged links to Islamist extremists.
The 24-year-old, who arrived in Germany in 2015, had been under surveillance by the German authorities this year on suspicion of planning a robbery to pay for automatic weapons for use in an attack.
But the surveillance was reportedly called off after it turned up nothing more than drug-dealing in a Berlin park and a bar brawl.
He is also believed to have moved in the same circles as extremist preacher Ahmad Abdelazziz A, known as Abu Walaa, who was charged last month with supporting so-called Islamic State (IS).
Amri was also on a US no-fly list, had researched explosives online and had communicated with IS at least once via the Telegram messenger service, the New York Times reported.
He had been due to be deported from Germany in June but stayed because there was a delay in receiving paperwork from Tunisia.
IS has said one of its militants carried out the attack but has offered no evidence.