A judge in Madrid on Saturday ordered the suspect to be held in custody pending a decision on whether to extradite him to the Netherlands, said a judicial source who asked not to be named.
Police seized the suspect, a 35-year-old from Alkmaar in the Netherlands, in Granollers near Barcelona on Thursday, under a European arrest warrant after last month's attack.
"He had been travelling around Spain in a van that he used as a mobile computing office, equipped with various antenna to scan for frequencies," police said in a statement.
The police statement described his home as "a real computing bunker", from where "he managed to give interviews to various international media about the cyber-attacks".
Also Read
Last month's attack targeted Spamhaus, a Geneva-based volunteer group that publishes blacklists of spam mail distributors.
It was a so-called distributed denial of service attack (DDoS), in which hackers bombard sites with traffic in order to jam them.
The Spanish police described it as the biggest ever such cyber-attack in history and said it slowed down web traffic in several countries, including the Netherlands, Britain and the United States.