Block domain for incoming mail

Hi all,

A client has two autoresponders created and one of them is being hammered by emails coming from *random number here*@qq.com. Seems to be some sort of Chinese domain name and others on the internet have had similar experience. So I decided to block the domain on the "Global Blocklist" section on the spam settings inside Nodeworx with: *@qq.com but they are somehow still triggering the autoresponder which then obvious fills up the mail queue.

Any ideas on how to stop this?