Comment 6 for bug 1412943

I found a decent workaround: use the main server "archive.ubuntu.com" instead of the mirror. Notice how it includes only the known-good addresses; security.ubuntu.com includes a mix of good and bad hosts, and us.archive.ubuntu.com includes only the bad ones.

$ dig +short archive.ubuntu.com aaaa
2001:67c:1360:8c01::18
2001:67c:1360:8c01::19

$ dig +short security.ubuntu.com aaaa
2001:67c:1562::16
2001:67c:1562::13
2001:67c:1562::14
2001:67c:1562::15
2001:67c:1360:8c01::18
2001:67c:1360:8c01::19
2001:67c:1562::17

$ dig +short us.archive.ubuntu.com aaaa
2001:67c:1562::13
2001:67c:1562::14
2001:67c:1562::15
2001:67c:1562::16
2001:67c:1562::17