Google's John Mueller said it is best to disavow all the possible places the link may be pointing to, even if you redirect one URL to another and someone is linking to the original URL. But he said Google can follow and see "links between canonical URLs, so when there's a redirect involved, you'd need to check which one is canonical."
He said this on Twitter and suggested that instead of you manually checking what Google thinks is the canonical URL, you can just save the time and disavow both cases.
Sorry -- I missed this :). Marie's recommendation of just disavowing both is probably easiest. On our side, we see links between canonical URLs, so when there's a redirect involved, you'd need to check which one is canonical. Doing both saves you the extra work :)
— 🍌 John 🍌 (@JohnMu) April 18, 2019
Here is the original question:
...because the site actually lands on site 2 url and that's the one that's evil spammy #sneakyspammers - this could be a senior moment for me and I'm making this harder than it has to be.. :D @JohnMu pic.twitter.com/YemVX0MztH
— Donna 'SnowWrite' Snow #techseo (@SnowWrite) April 17, 2019
Marie Haynes said:
Also, important point...does the page redirected to actually contain a link to your site? If not, you can ignore. If so, then you need to disavow site2.
— Marie Haynes (@Marie_Haynes) April 18, 2019
Sometimes redirect chains and canonicals are not always so clear and transparent. So try to keep it simple.
Forum discussion at Twitter.