The Islamic State jihadist group on Friday claimed responsibility for car bombings at two upscale Baghdad hotels that officials said killed at least nine people and wounded dozens.

Militants were able to transport the bombs, which exploded just before midnight (2100 GMT) on Thursday and were heard across the city centre, inside the walled compounds of the Ishtar and Babylon hotels in central Baghdad.

IS -- which has overrun swathes of territory north and west of Baghdad since June last year -- claimed the bombings in an online statement, saying one car bomb was left at the Ishtar while the Babylon blast was a suicide attack.

A police colonel also said that it was a suicide bomber who had targeted the Babylon.

The blast at the Ishtar -- formerly a Sheraton -- shattered windows of the recently renovated hotel, turning rows of expensive cars and SUVs into charred, twisted metal.

The force of the explosion turned some cars on their sides, and more than 15 heavily damaged vehicles still sat in the car park on Friday.

The Ishtar is a popular site for wedding celebrations, and the area -- which also includes a club and the Palestine Hotel -- is crowded with people on Thursday nights.

IS frequently targets areas where crowds of people gather, including markets, cafes and mosques.

A man named Raad, standing near the blast site at the Ishtar, said it was one of the most secure places for both foreigners and Iraqis.

That a bombing can still happen even here "means there is no security," he said.

- Inadequate security measures -

Despite the bombing, security at the entrance to the Ishtar compound was still light on Friday, and one man told guards that the "same procedures" were in place before and failed to stop the attack.

Other upscale Baghdad hotels also suffer from lax security measures, including cursory searches of vehicles and the use of bomb "detectors" that have been proven to be fake.

A second bombing struck the car park at the Babylon, another upmarket and recently refurbished hotel that overlooks the Tigris river, late on Thursday.

Police said security forces found another car bomb in the Babylon car park and defused the device.

The Babylon blast left holes in a section of the hotel and shattered its windows.

A flatbed truck could be seen carrying a burned car out of the car park on Friday, while other damaged vehicles remained there.

The government lifted a years-old midnight curfew in February after Iraqi forces retook areas around Baghdad from IS and dismantled a major car bomb-making cell.

Attacks have continued since but are less frequent than in 2014.

IS, which is still battling government forces barely 30 kilometres (18 miles) west of the capital, has claimed many of the biggest attacks in Baghdad and elsewhere in the country.

The Babylon and Sheraton were hit in coordinated attacks in January 2010, as was the Hamra which never reopened.

The attacks five years ago were carried out by suicide bombers and killed at least 36 people. They were claimed by Al-Qaeda in Iraq, the group that later became IS.