Do not disavow.
If you don't know what you're doing, disavow can do extremely serious damage to your site and revenue.
The notion that some paid SEO tools can detect spammy sites but Google can't is almost funny. Disavow is no longer necessary as Google detects spammy sites and adds zero weight to those inbound links.
(This of course is a subject of ...