The suspect, a Moroccan national called Abdeladim Achriaa, had lived in Spain for years but was arrested on Tuesday in a joint Spanish-Moroccan police operation south of Madrid that targeted alleged supporters of the Islamic State group.
Achriaa applied for bail but National Court judge Juan Pablo Gonzalez rejected his request on Thursday, saying he posed a flight risk and ordering him to be kept behind bars while the investigation continues.
"Abdeladim was coordinating the members of a Syrian-Iraqi affiliate of Islamic State deployed in several cities in Morocco," the judge wrote after questioning Achriaa in court.
The aim was for them to eventually join Islamic State fighters in Syria and Iraq, he said, noting that Achriaa had several Facebook profiles, one of which gave his name as 'salami Jihadi'.
Officials in Madrid and Rabat said the network sought to recruit IS jihadists to join the fighting in Iraq and Syria and also to carry out attacks in Spain and Morocco.
"They were aiming to mimic in Spain and Morocco the massacres carried out by Islamic State members with the intention of creating a climate of mass panic and instability," the Spanish Interior Ministry said following the arrests.
During Tuesday's arrest operation, police in Morocco also arrested another 13 people in Fez, Casablanca, Nador, Al Hoceima and Driouech as part of the same investigation.
One of them was the father of a woman called Hafsa Azaoum, who is Achriaa's partner. Five of Azaoum's brothers have gone to Syria to fight for the IS jihadists, the judge said.
Tuesday's arrests came just days after passengers on a crowded Paris-bound train tackled and disarmed a heavily-armed Moroccan man who used to live in Spain, halting what authorities say could have been a bloodbath.
Spain is on 'high alert' for a terrorist attack, at level four on a scale of five, that from this week will be published on the Interior Ministry website.