Pre-resolve "time.android.com" by searching it on browserleaks.com
Go to: https://browserleaks.com/ip/time.android.com
You will obtain the CNAME or the equivalent IP addresses
if protocol is UDP because most NTP domains are UDP as they are responsible for checking time in real-time with lowest latency.
Adding to either [Rule] or [General] as shown below will make the target domain match the Local DNS Mapping items in [Host]:
[Rule]
DOMAIN,time.android.com,DIRECT,extended-matching
OR
[General]
always-real-ip = time.android.com
[Host]
time.android.com = time3.google.com
OR
time.android.com = 216.239.35.8, 216.239.35.4, 216.239.35.0, 216.239.35.12, 2001:4860:4806:8::, 2001:4860:4806:c::, 2001:4860:4806:4::, 2001:4860:4806::
If it is HTTP(s) protocol use URL Rewrite type 302. For example;
[MITM]
hostname = example.domain.com:port, clients2.google.com:443
[URL Rewrite]
#TYPE 302
#========
http://example.domain.com https://example.net 302
A specific case of an NTP domain used by google as a good example is below:
http://clients2.google.com/time/1/current* https://sfo03s24-in-f14.1e100.net 302
If the request is a TCP, add the target domain to "force-http-engine-hosts" to make it HTTP and then add it to [MITM] hostnames if you need sub-path as shown in the google time server example