John Mueller in the Friday morning's Google Hangout on Google+ said at the 54 minute mark that if you get a manual action and you want to submit a reconsideration request, you need to make sure the file is submitted to the canonical version of the domain with the manual action. If you are unsure, he said you can post the disavow file on all versions of the domain name if you want.
The question was:
Recently a website registered four properties to Google Search Console, and set canonical/redirect to https://www. http://www(not canonical) got manual action, so we'd like to disavow. Is it enough to submit file only to http://www and https://www, or better to submit to all four?
His answer was:
For the disavow links, we need that on the canonical version of the pages that those links are pointing to. So if you have HTTP and you're redirecting to https and we're indexing HTTPS now, then that's the version you need to have the disavow file on. That said if you're not sure especially if you're like in the middle of a site move and some urls are here and some urls are here, then you can just take the same file and uploaded on both versions and that's fine for us too.
Here is the video embed:
Forum discussion at Google+.