Mailfilter syntax question - one or more sets

Hello, I am trying to block some spam using maildropfilter (the
..mailfilter file, not sure which version, sorry). Each spam header has
a fingerprint such as:

(port=3480 helo=[wrestling])

The port numbers and helo text changes, so I'd like to filter for one
or more alphanumeric character, but can't get the syntax right. I've
tried these two conditionals:

if (/\(port=[:alpha:]* helo=\[[:alpha:]*\]\)/)

if (/\(port=[:alpha:*] helo=\[[:alpha:*]\]\)/)

For now, I'll try .* and hope it knows to stop counting "one or more of
any character" when it sees 'helo=['. Will it?
if (/\(port=.* helo=\[.*\]\)/)

Thanks in advance for your help.

I'm still trying this. Now I'm trying to filter against random words
within an EHLO, such as:
(EHLO katwalk)

Again, requires one or more of any letter. But how is that coded? My
attempt is:
if (/\(EHLO ([:alpha:])+\))/)

I'll have to receive junk from that specific spammer before I'll know
it worked. Can anyone confirm?

Yes, I've confirmed that one or more of a set of characters is coded:

([:alpha:])+

:alpha: may be replaced with :alnum:, :digit:, :lower:, :space:, etc
+ may be replaced with ? (0 or 1 from the set), * (0 or more from the
set), etc.