I found a decent workaround: use the main server "archive.ubuntu.com" instead of the mirror. Notice how it includes only the known-good addresses; security.ubuntu.com includes a mix of good and bad hosts, and us.archive.ubuntu.com includes only the bad ones.
I found a decent workaround: use the main server "archive. ubuntu. com" instead of the mirror. Notice how it includes only the known-good addresses; security.ubuntu.com includes a mix of good and bad hosts, and us.archive. ubuntu. com includes only the bad ones.
$ dig +short archive.ubuntu.com aaaa 1360:8c01: :18 1360:8c01: :19
2001:67c:
2001:67c:
$ dig +short security.ubuntu.com aaaa 1360:8c01: :18 1360:8c01: :19
2001:67c:1562::16
2001:67c:1562::13
2001:67c:1562::14
2001:67c:1562::15
2001:67c:
2001:67c:
2001:67c:1562::17
$ dig +short us.archive. ubuntu. com aaaa
2001:67c:1562::13
2001:67c:1562::14
2001:67c:1562::15
2001:67c:1562::16
2001:67c:1562::17