diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 6127df218f..5cb5a75167 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -61,8 +61,13 @@ jobs:
           current_benchmark_results.json
         retention-days: 30
 
-    # Comment on PR with benchmark results
+    # Comment on PR with benchmark results.
+    # A pull_request run from a fork gets a read-only GITHUB_TOKEN no matter what
+    # the permissions block above says, so commenting is impossible there and the
+    # attempt fails the whole job with a 403. The report is still in the uploaded
+    # artifact either way.
     - name: Comment benchmark results on PR
+      if: github.event.pull_request.head.repo.full_name == github.repository
       uses: actions/github-script@v9
       with:
         script: |
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 12225e1b9e..d81333f76b 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -38,7 +38,7 @@ jobs:
         env:
           BBOT_IO_API_KEY: ${{ secrets.BBOT_IO_API_KEY }}
         run: |
-          uv run pytest -vv --reruns 2 -o timeout_func_only=true --timeout 1200 --disable-warnings --log-cli-level=INFO --cov-config=bbot/test/coverage.cfg --cov-report xml:cov.xml --cov=bbot .
+          uv run pytest -vv -n $(python bbot/test/worker_count.py) --dist loadgroup --reruns 2 -o timeout_func_only=true --timeout 1200 --disable-warnings --log-cli-level=INFO --cov-config=bbot/test/coverage.cfg --cov-report xml:cov.xml --cov=bbot .
       - name: Upload Debug Logs
         if: always()
         uses: actions/upload-artifact@v7
diff --git a/bbot/test/bbot_fixtures.py b/bbot/test/bbot_fixtures.py
index df8a7cb547..f296a65c4c 100644
--- a/bbot/test/bbot_fixtures.py
+++ b/bbot/test/bbot_fixtures.py
@@ -15,12 +15,15 @@
 from bbot.core.config.merge import deep_merge
 from bbot.scanner import Preset
 from bbot.core.helpers.misc import mkdir, rand_string
+from bbot.test.worker import BBOT_TEST_DIR
 
 
 log = logging.getLogger("bbot.test.fixtures")
 
 
-bbot_test_dir = Path("/tmp/.bbot_test")
+# Per-xdist-worker so parallel workers don't share caches, scan output, or the
+# sessionfinish cleanup. Serial runs still get /tmp/.bbot_test.
+bbot_test_dir = BBOT_TEST_DIR
 mkdir(bbot_test_dir)
 
 
diff --git a/bbot/test/conftest.py b/bbot/test/conftest.py
index d82a982db4..d7caf4aac5 100644
--- a/bbot/test/conftest.py
+++ b/bbot/test/conftest.py
@@ -10,6 +10,13 @@
 from contextlib import suppress
 from pytest_httpserver import HTTPServer
 
+from bbot.test.worker import (
+    BBOT_TEST_DIR,
+    HTTPSERVER_ALLINTERFACES_PORT,
+    HTTPSERVER_PORT,
+    HTTPSERVER_SSL_PORT,
+)
+
 from bbot.core import CORE
 from bbot.core.helpers.misc import execute_sync_or_async
 from bbot.core.helpers.interactsh import server_list as interactsh_servers
@@ -26,12 +33,28 @@
 with open(Path(__file__).parent / "test.conf") as _f:
     test_config = yaml.safe_load(_f) or {}
 
+# Give each xdist worker its own BBOT home. test.conf carries the serial default;
+# under -n the workers would otherwise share caches, scan output and temp files,
+# and the sessionfinish cleanup below would delete a directory still in use.
+test_config["home"] = str(BBOT_TEST_DIR)
+
 os.environ["BBOT_DEBUG"] = "True"
 CORE.logger.log_level = logging.DEBUG
 
 # silence all stderr output:
 stderr_handler = CORE.logger.log_handlers["stderr"]
 stderr_handler.setLevel(logging.CRITICAL)
+# worker.py clears _BBOT_LOGGING_SETUP for xdist workers, so every process that
+# reaches here (serial or worker) owns a real QueueListener. If it is missing,
+# logging never got set up and debug.log would silently stay empty, so fail
+# loudly instead of continuing with logging quietly broken.
+if CORE.logger.listener is None:
+    raise RuntimeError(
+        "BBOT logging was not initialized in this process "
+        f"(PYTEST_XDIST_WORKER={os.environ.get('PYTEST_XDIST_WORKER', '')!r}). "
+        "debug.log would be empty and log-reading tests would fail with "
+        "confusing assertion errors."
+    )
 handlers = list(CORE.logger.listener.handlers)
 handlers.remove(stderr_handler)
 CORE.logger.listener.handlers = tuple(handlers)
@@ -96,7 +119,7 @@ def stop_server(server):
 
 @pytest.fixture
 def bbot_httpserver():
-    server = HTTPServer(host="127.0.0.1", port=8888, threaded=True)
+    server = HTTPServer(host="127.0.0.1", port=HTTPSERVER_PORT, threaded=True)
     server.start()
 
     yield server
@@ -115,7 +138,7 @@ def bbot_httpserver_ssl():
     keyfile = str(current_dir / "testsslkey.pem")
     certfile = str(current_dir / "testsslcert.pem")
     context.load_cert_chain(certfile, keyfile)
-    server = HTTPServer(host="127.0.0.1", port=9999, ssl_context=context, threaded=True)
+    server = HTTPServer(host="127.0.0.1", port=HTTPSERVER_SSL_PORT, ssl_context=context, threaded=True)
     server.start()
 
     yield server
@@ -222,7 +245,7 @@ async def patched_request_batch_stream(self, urls, threads=10, **kwargs):
 
 @pytest.fixture
 def bbot_httpserver_allinterfaces():
-    server = HTTPServer(host="0.0.0.0", port=5556, threaded=True)
+    server = HTTPServer(host="0.0.0.0", port=HTTPSERVER_ALLINTERFACES_PORT, threaded=True)
     server.start()
 
     yield server
@@ -334,6 +357,20 @@ def proxy_server():
     server_thread.join()
 
 
+def pytest_collection_modifyitems(config, items):
+    """Pin docker-backed tests to one xdist worker.
+
+    They start real containers with fixed names and fixed host port bindings
+    (kafka, elastic, mongo, mysql, nats, postgres, rabbitmq), so two workers
+    running them at once fight over both. They already mark themselves with
+    ``skip_distro_tests``, so reuse that as the signal.
+    """
+    for item in items:
+        cls = getattr(item, "cls", None)
+        if cls is not None and getattr(cls, "skip_distro_tests", False):
+            item.add_marker(pytest.mark.xdist_group("docker"))
+
+
 def pytest_terminal_summary(terminalreporter, exitstatus, config):  # pragma: no cover
     RED = "\033[1;31m"
     GREEN = "\033[1;32m"
@@ -460,8 +497,10 @@ def pytest_sessionfinish(session, exitstatus):
             if child.is_alive():
                 child.kill()
 
-    # Wipe out BBOT home dir
-    shutil.rmtree("/tmp/.bbot_test", ignore_errors=True)
+    # Wipe out BBOT home dir. Scoped to this worker: under xdist the first
+    # worker to finish would otherwise delete the directory out from under
+    # every worker still running.
+    shutil.rmtree(BBOT_TEST_DIR, ignore_errors=True)
 
     # Ensure stdout/stderr are blocking before pytest writes summaries
     try:
diff --git a/bbot/test/test_step_1/test_bbot_fastapi.py b/bbot/test/test_step_1/test_bbot_fastapi.py
index 2c122f3191..e00f39c328 100644
--- a/bbot/test/test_step_1/test_bbot_fastapi.py
+++ b/bbot/test/test_step_1/test_bbot_fastapi.py
@@ -7,6 +7,7 @@
 from urllib.request import urlopen, Request
 from urllib.error import URLError
 from urllib.parse import urlencode
+from bbot.test.worker import FASTAPI_PORT, FASTAPI_URL, HTTPSERVER_URL
 
 cwd = Path(__file__).parent.parent.parent
 
@@ -14,7 +15,7 @@
 def run_bbot_multiprocess(queue):
     from bbot.scanner import Scanner
 
-    scan = Scanner("http://127.0.0.1:8888", "blacklanternsecurity.com", modules=["http"])
+    scan = Scanner(HTTPSERVER_URL, "blacklanternsecurity.com", modules=["http"])
     events = [e.json() for e in scan.start()]
     queue.put(events)
 
@@ -42,7 +43,7 @@ def test_bbot_fastapi(bbot_httpserver):
         start_time = time.time()
         while True:
             try:
-                response = urlopen("http://127.0.0.1:8978/ping")
+                response = urlopen(f"{FASTAPI_URL}/ping")
                 response.read()
                 break
             except (URLError, ConnectionError):
@@ -52,8 +53,8 @@ def test_bbot_fastapi(bbot_httpserver):
                 continue
 
         # run a scan
-        params = urlencode({"targets": ["http://127.0.0.1:8888", "blacklanternsecurity.com"]}, doseq=True)
-        req = Request(f"http://127.0.0.1:8978/start?{params}")
+        params = urlencode({"targets": [HTTPSERVER_URL, "blacklanternsecurity.com"]}, doseq=True)
+        req = Request(f"{FASTAPI_URL}/start?{params}")
         response = urlopen(req, timeout=100)
         events = json.loads(response.read())
         assert len(events) >= 3
@@ -75,6 +76,8 @@ def start_fastapi_server():
         del env["BBOT_TESTING"]
     python_executable = str(sys.executable)
     process = Popen(
-        [python_executable, "-m", "uvicorn", "bbot.test.fastapi_test:app", "--port", "8978"], cwd=cwd, env=env
+        [python_executable, "-m", "uvicorn", "bbot.test.fastapi_test:app", "--port", str(FASTAPI_PORT)],
+        cwd=cwd,
+        env=env,
     )
     return process
diff --git a/bbot/test/test_step_1/test_cli.py b/bbot/test/test_step_1/test_cli.py
index c8321283cd..2db0037d12 100644
--- a/bbot/test/test_step_1/test_cli.py
+++ b/bbot/test/test_step_1/test_cli.py
@@ -871,6 +871,12 @@ def test_cli_presets(monkeypatch, capsys, caplog, clean_default_config):
         """
         )
 
+    # These are cleaned up at the end of the test, but an earlier failure (or an
+    # interrupted run) leaves them behind, and then these "not exists" assertions
+    # fail on every later run against the same BBOT home. Clear them up front so
+    # the test establishes its precondition instead of assuming it.
+    shutil.rmtree(output_dir, ignore_errors=True)
+
     assert not output_dir.exists()
     assert not scan_dir.exists()
     assert not output_file.exists()
diff --git a/bbot/test/test_step_1/test_command.py b/bbot/test/test_step_1/test_command.py
index 54bbdaba25..f8789f8588 100644
--- a/bbot/test/test_step_1/test_command.py
+++ b/bbot/test/test_step_1/test_command.py
@@ -1,5 +1,7 @@
 import time
 from ..bbot_fixtures import *
+
+from bbot.test.worker import BBOT_TEST_DIR
 from subprocess import CalledProcessError
 
 
@@ -38,7 +40,7 @@ async def test_command(bbot_scanner):
     assert result.splitlines() == [b"some", b"random", b"stdin"]
 
     # test overflow - run
-    tmpfile_path = Path("/tmp/test_bigfile")
+    tmpfile_path = BBOT_TEST_DIR / "test_bigfile"
     with open(tmpfile_path, "w") as f:
         # write 2MB
         f.write("A" * 1024 * 1024 * 2)
@@ -46,7 +48,7 @@ async def test_command(bbot_scanner):
     assert len(result) == 1024 * 1024 * 2
     tmpfile_path.unlink(missing_ok=True)
     # test overflow - run_live
-    tmpfile_path = Path("/tmp/test_bigfile")
+    tmpfile_path = BBOT_TEST_DIR / "test_bigfile"
     with open(tmpfile_path, "w") as f:
         # write 2MB
         f.write("A" * 10 + "\n")
@@ -119,30 +121,30 @@ async def test_command(bbot_scanner):
     # test sudo + existence of environment variables
     await scan1._prep()
     path_parts = os.environ.get("PATH", "").split(":")
-    assert "/tmp/.bbot_test/tools" in path_parts
+    assert f"{BBOT_TEST_DIR}/tools" in path_parts
     run_lines = (await scan1.helpers.run(["env"])).stdout.splitlines()
     assert "BBOT_WEB_USER_AGENT=BBOT Test User-Agent" in run_lines
     for line in run_lines:
         if line.startswith("PATH="):
             path_parts = line.split("=", 1)[-1].split(":")
-            assert "/tmp/.bbot_test/tools" in path_parts
+            assert f"{BBOT_TEST_DIR}/tools" in path_parts
     run_lines_sudo = (await scan1.helpers.run(["env"], sudo=True)).stdout.splitlines()
     assert "BBOT_WEB_USER_AGENT=BBOT Test User-Agent" in run_lines_sudo
     for line in run_lines_sudo:
         if line.startswith("PATH="):
             path_parts = line.split("=", 1)[-1].split(":")
-            assert "/tmp/.bbot_test/tools" in path_parts
+            assert f"{BBOT_TEST_DIR}/tools" in path_parts
     run_live_lines = [l async for l in scan1.helpers.run_live(["env"])]
     assert "BBOT_WEB_USER_AGENT=BBOT Test User-Agent" in run_live_lines
     for line in run_live_lines:
         if line.startswith("PATH="):
             path_parts = line.strip().split("=", 1)[-1].split(":")
-            assert "/tmp/.bbot_test/tools" in path_parts
+            assert f"{BBOT_TEST_DIR}/tools" in path_parts
     run_live_lines_sudo = [l async for l in scan1.helpers.run_live(["env"], sudo=True)]
     assert "BBOT_WEB_USER_AGENT=BBOT Test User-Agent" in run_live_lines_sudo
     for line in run_live_lines_sudo:
         if line.startswith("PATH="):
             path_parts = line.strip().split("=", 1)[-1].split(":")
-            assert "/tmp/.bbot_test/tools" in path_parts
+            assert f"{BBOT_TEST_DIR}/tools" in path_parts
 
     await scan1._cleanup()
diff --git a/bbot/test/test_step_1/test_excavate_url_regexes.py b/bbot/test/test_step_1/test_excavate_url_regexes.py
index d1a30dc50d..69369fa916 100644
--- a/bbot/test/test_step_1/test_excavate_url_regexes.py
+++ b/bbot/test/test_step_1/test_excavate_url_regexes.py
@@ -11,6 +11,7 @@
 import yara
 
 from bbot.modules.internal.excavate import excavate
+from bbot.test.worker import HTTPSERVER_URL
 
 
 full_url_regex = excavate.URLExtractor.full_url_regex
@@ -30,7 +31,7 @@
 NON_IPV6_URLS = [
     "http://example.com/",
     "https://www.example.com:8080/path",
-    "http://127.0.0.1:8888/",
+    f"{HTTPSERVER_URL}/",
     "https://asdffoo.test.notreal/some/path",
 ]
 
diff --git a/bbot/test/test_step_1/test_manager_scope_accuracy.py b/bbot/test/test_step_1/test_manager_scope_accuracy.py
index fb6b5c4c95..66d80773bf 100644
--- a/bbot/test/test_step_1/test_manager_scope_accuracy.py
+++ b/bbot/test/test_step_1/test_manager_scope_accuracy.py
@@ -12,12 +12,27 @@
 from ..bbot_fixtures import *  # noqa: F401
 
 from pytest_httpserver import HTTPServer
+from bbot.test.worker import (
+    HTTPSERVER_HOSTPORT,
+    HTTPSERVER_PORT,
+    HTTPSERVER_PORT_ALT,
+    HTTPSERVER_SSL_HOSTPORT,
+    HTTPSERVER_SSL_PORT,
+    HTTPSERVER_URL,
+)
 
 
 @pytest.fixture
 def bbot_other_httpservers():
 
-    server_hosts = [("127.0.0.77", 8888), ("127.0.0.88", 8888), ("127.0.0.99", 8888), ("127.0.0.111", 8888), ("127.0.0.222", 8889), ("127.0.0.33", 8889)]
+    server_hosts = [
+        ("127.0.0.77", HTTPSERVER_PORT),
+        ("127.0.0.88", HTTPSERVER_PORT),
+        ("127.0.0.99", HTTPSERVER_PORT),
+        ("127.0.0.111", HTTPSERVER_PORT),
+        ("127.0.0.222", HTTPSERVER_PORT_ALT),
+        ("127.0.0.33", HTTPSERVER_PORT_ALT),
+    ]
 
     servers = [HTTPServer(host=host, port=port, threaded=True) for host, port in server_hosts]
     for server in servers:
@@ -47,13 +62,13 @@ async def test_manager_scope_accuracy_correct(bbot_scanner, bbot_httpserver, bbo
 
     server_77, server_88, server_99, server_111, server_222, server_33 = bbot_other_httpservers
 
-    bbot_httpserver.expect_request(uri="/").respond_with_data(response_data="<a href='http://127.0.0.77:8888'/>")
-    server_77.expect_request(uri="/").respond_with_data(response_data="<a href='http://127.0.0.88:8888'/>")
-    server_88.expect_request(uri="/").respond_with_data(response_data="<a href='http://127.0.0.99:8888'/>")
-    server_99.expect_request(uri="/").respond_with_data(response_data="<a href='http://127.0.0.111:8888'/>")
-    server_111.expect_request(uri="/").respond_with_data(response_data="<a href='http://127.0.0.222:8889'/><a href='http://127.0.0.33:8889'/>")
-    server_222.expect_request(uri="/").respond_with_data(response_data="<a href='http://127.0.0.44:8888'/>")
-    server_33.expect_request(uri="/").respond_with_data(response_data="<a href='http://127.0.0.55:8888'/>")
+    bbot_httpserver.expect_request(uri="/").respond_with_data(response_data=f"<a href='http://127.0.0.77:{HTTPSERVER_PORT}'/>")
+    server_77.expect_request(uri="/").respond_with_data(response_data=f"<a href='http://127.0.0.88:{HTTPSERVER_PORT}'/>")
+    server_88.expect_request(uri="/").respond_with_data(response_data=f"<a href='http://127.0.0.99:{HTTPSERVER_PORT}'/>")
+    server_99.expect_request(uri="/").respond_with_data(response_data=f"<a href='http://127.0.0.111:{HTTPSERVER_PORT}'/>")
+    server_111.expect_request(uri="/").respond_with_data(response_data=f"<a href='http://127.0.0.222:{HTTPSERVER_PORT_ALT}'/><a href='http://127.0.0.33:{HTTPSERVER_PORT_ALT}'/>")
+    server_222.expect_request(uri="/").respond_with_data(response_data=f"<a href='http://127.0.0.44:{HTTPSERVER_PORT}'/>")
+    server_33.expect_request(uri="/").respond_with_data(response_data=f"<a href='http://127.0.0.55:{HTTPSERVER_PORT}'/>")
 
     class DummyModule(BaseModule):
         _name = "dummy_module"
@@ -295,7 +310,7 @@ def custom_setup(scan):
             "scope": {"report_distance": 1, "search_distance": 0},
             "speculate": True,
             "excavate": True,
-            "modules": {"speculate": {"ports": "8888"}},
+            "modules": {"speculate": {"ports": f"{HTTPSERVER_PORT}"}},
             "omit_event_types": ["HTTP_RESPONSE", "URL_UNVERIFIED"],
         },
         _dns_mock={},
@@ -305,54 +320,54 @@ def custom_setup(scan):
     assert 1 == len([e for e in events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888"])
-    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}"])
+    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}"])
 
     assert len(all_events) == 14
     assert 1 == len([e for e in all_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 0])
     assert 2 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888" and e.internal is True and e.scope_distance == 0])
-    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
 
     assert len(all_events_nodups) == 12
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
 
     for _graph_output_events in (graph_output_events, graph_output_batch_events):
         assert len(_graph_output_events) == 7
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}"])
 
     # http/speculate IP_RANGE --> IP_ADDRESS --> OPEN_TCP_PORT --> URL, search distance = 0, in_scope_only = False
     events, all_events, all_events_nodups, graph_output_events, graph_output_batch_events = await do_scan(
@@ -363,7 +378,7 @@ def custom_setup(scan):
             "scope": {"search_distance": 0, "report_distance": 1},
             "excavate": True,
             "speculate": True,
-            "modules": {"http": {"in_scope_only": False}, "speculate": {"ports": "8888"}},
+            "modules": {"http": {"in_scope_only": False}, "speculate": {"ports": f"{HTTPSERVER_PORT}"}},
             "omit_event_types": ["HTTP_RESPONSE", "URL_UNVERIFIED"],
         },
     )
@@ -377,70 +392,70 @@ def custom_setup(scan):
     assert 1 == len([e for e in events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888"])
-    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}"])
+    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888"])
-    assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.77:8888"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}"])
+    assert 1 == len([e for e in events if e.type == "URL" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.77:{HTTPSERVER_PORT}"])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.88"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
 
     assert len(all_events) == 18
     assert 1 == len([e for e in all_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 0])
     assert 2 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888" and e.internal is True and e.scope_distance == 0])
-    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.88" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.88:8888/" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.88:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 2])
 
     assert len(all_events_nodups) == 16
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.88" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.88:8888/" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.88:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 2])
 
     for _graph_output_events in (graph_output_events, graph_output_batch_events):
         assert len(_graph_output_events) == 8
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/" and "spider-danger" in e.tags])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and "spider-danger" in e.tags])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.77:8888/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.88"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.88:8888/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.88:{HTTPSERVER_PORT}/"])
 
     # http/speculate IP_RANGE --> IP_ADDRESS --> OPEN_TCP_PORT --> URL, search distance = 1
     events, all_events, all_events_nodups, graph_output_events, graph_output_batch_events = await do_scan(
@@ -451,7 +466,7 @@ def custom_setup(scan):
             "scope": {"report_distance": 1, "search_distance": 1},
             "excavate": True,
             "speculate": True,
-            "modules": {"http": {"in_scope_only": False}, "speculate": {"ports": "8888"}},
+            "modules": {"http": {"in_scope_only": False}, "speculate": {"ports": f"{HTTPSERVER_PORT}"}},
             "omit_event_types": ["HTTP_RESPONSE", "URL_UNVERIFIED"],
         },
     )
@@ -460,78 +475,78 @@ def custom_setup(scan):
     assert 1 == len([e for e in events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888"])
-    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}"])
+    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888"])
-    assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.77:8888/"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}"])
+    assert 1 == len([e for e in events if e.type == "URL" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.88"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
 
     assert len(all_events) == 22
     assert 1 == len([e for e in all_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 0])
     assert 2 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888" and e.internal is True and e.scope_distance == 0])
-    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.88:8888/" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.88:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 2])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.88" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.88:8888" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.88:8888/" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.88:8888/" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.99:8888/" and e.internal is True and e.scope_distance == 3])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.88:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"http://127.0.0.88:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.88:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.99:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 3])
 
     assert len(all_events_nodups) == 20
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1 and "spider-danger" in e.tags])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.88:8888/" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.88:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 2])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.88" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.88:8888" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.88:8888/" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.88:8888/" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.99:8888/" and e.internal is True and e.scope_distance == 3])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.88:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"http://127.0.0.88:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.88:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.99:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 3])
 
     for _graph_output_events in (graph_output_events, graph_output_batch_events):
         assert len(_graph_output_events) == 8
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:8888"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:8888" and e.internal is False and e.scope_distance == 0])
-        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.1:8888"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.77:8888/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_HOSTPORT and e.internal is False and e.scope_distance == 0])
+        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and e.internal is False and e.scope_distance == 0])
+        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == HTTPSERVER_HOSTPORT])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.77" and e.internal is False and e.scope_distance == 1])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.77:8888"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == "http://127.0.0.77:8888/" and e.internal is False and e.scope_distance == 1])
-        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.77:8888/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.77:{HTTPSERVER_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == f"http://127.0.0.77:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 1])
+        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.77:{HTTPSERVER_PORT}/"])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.88"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.88:8888/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.88:{HTTPSERVER_PORT}/"])
 
     # 2 events from a single HTTP_RESPONSE
     events, all_events, all_events_nodups, graph_output_events, graph_output_batch_events = await do_scan(
@@ -546,7 +561,7 @@ def custom_setup(scan):
             "scope": {"search_distance": 0, "report_distance": 0},
             "excavate": True,
             "speculate": True,
-            "modules": {"speculate": {"ports": "8888"}},
+            "modules": {"speculate": {"ports": f"{HTTPSERVER_PORT}"}},
             "omit_event_types": ["HTTP_RESPONSE", "URL_UNVERIFIED"],
         },
     )
@@ -555,120 +570,120 @@ def custom_setup(scan):
     assert 1 == len([e for e in events if e.type == "IP_RANGE" and e.data == "127.0.0.110/31" and e.internal is False and e.scope_distance == 0])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.110"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.111" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.110:8888"])
-    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.111:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.111:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.111:8888"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.111:8888/"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.222:8889/"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.110:{HTTPSERVER_PORT}"])
+    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.111:{HTTPSERVER_PORT}" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in events if e.type == "URL" and e.url == f"http://127.0.0.111:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 0])
+    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.111:{HTTPSERVER_PORT}"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.111:{HTTPSERVER_PORT}/"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.222" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.33:8889/"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.33" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8888"])
-    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8889"])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8888"])
-    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8889"])
-    assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.222:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.222:8889"])
-    assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.33:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.33:8889"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.44:8888/"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT}"])
+    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT_ALT}"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT}"])
+    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT_ALT}"])
+    assert 1 == len([e for e in events if e.type == "URL" and e.url == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.222:{HTTPSERVER_PORT_ALT}"])
+    assert 1 == len([e for e in events if e.type == "URL" and e.url == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 0 == len([e for e in events if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.33:{HTTPSERVER_PORT_ALT}"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.44:{HTTPSERVER_PORT}/"])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.44"])
-    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.55:8888/"])
+    assert 0 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.55:{HTTPSERVER_PORT}/"])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.55"])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.44:8888"])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.55:8888"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.44:{HTTPSERVER_PORT}"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.55:{HTTPSERVER_PORT}"])
 
     assert len(all_events) == 31
     assert 1 == len([e for e in all_events if e.type == "IP_RANGE" and e.data == "127.0.0.110/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.110" and e.internal is True and e.scope_distance == 0])
     assert 2 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.111" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.110:8888" and e.internal is True and e.scope_distance == 0])
-    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.111:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.111:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.111:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.111:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.222:8889/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.110:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.111:{HTTPSERVER_PORT}" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"http://127.0.0.111:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.111:{HTTPSERVER_PORT}" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.111:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.222" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.33:8889/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.33" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8888" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8889" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8889" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8888" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8889" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8889" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.222:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.222:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == "http://127.0.0.33:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.33:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.44:8888/" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT_ALT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT_ALT}" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT_ALT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT_ALT}" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL" and e.url == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.44:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 1])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.44" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.55:8888/" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.55:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 1])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.55" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.44:8888" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.55:8888" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.44:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.55:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
 
     assert len(all_events_nodups) == 27
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_RANGE" and e.data == "127.0.0.110/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.110" and e.internal is True and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.111" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.110:8888" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.111:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.111:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.111:8888" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.111:8888/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.222:8889/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.110:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.111:{HTTPSERVER_PORT}" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"http://127.0.0.111:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.111:{HTTPSERVER_PORT}" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.111:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.222" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.33:8889/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.33" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8888" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8889" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8888" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8889" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.222:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.222:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == "http://127.0.0.33:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == "http://127.0.0.33:8889/" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.44:8888/" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT_ALT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT_ALT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL" and e.url == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and e.data["url"] == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.44:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 1])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.44" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.55:8888/" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.55:{HTTPSERVER_PORT}/" and e.internal is True and e.scope_distance == 1])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.55" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.44:8888" and e.internal is True and e.scope_distance == 1])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.55:8888" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.44:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.55:{HTTPSERVER_PORT}" and e.internal is True and e.scope_distance == 1])
 
     for _graph_output_events in (graph_output_events, graph_output_batch_events):
         assert len(_graph_output_events) == 12
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_RANGE" and e.data == "127.0.0.110/31" and e.internal is False and e.scope_distance == 0])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.110"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.111" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.110:8888"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.111:8888" and e.internal is False and e.scope_distance == 0])
-        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == "http://127.0.0.111:8888/" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.111:8888"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.111:8888/"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.222:8889/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.110:{HTTPSERVER_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.111:{HTTPSERVER_PORT}" and e.internal is False and e.scope_distance == 0])
+        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == f"http://127.0.0.111:{HTTPSERVER_PORT}/" and e.internal is False and e.scope_distance == 0])
+        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.111:{HTTPSERVER_PORT}"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.111:{HTTPSERVER_PORT}/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.222"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.33:8889/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.33"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8888"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.222:8889"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8888"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.33:8889"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == "http://127.0.0.222:8889/" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.222:8889"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == "http://127.0.0.33:8889/" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == "127.0.0.33:8889"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.44:8888/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.222:{HTTPSERVER_PORT_ALT}"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.33:{HTTPSERVER_PORT_ALT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == f"http://127.0.0.222:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.222:{HTTPSERVER_PORT_ALT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "URL" and e.url == f"http://127.0.0.33:{HTTPSERVER_PORT_ALT}/" and e.internal is False and e.scope_distance == 0])
+        assert 0 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and e.data["input"] == f"127.0.0.33:{HTTPSERVER_PORT_ALT}"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.44:{HTTPSERVER_PORT}/"])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.44"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.55:8888/"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and e.url == f"http://127.0.0.55:{HTTPSERVER_PORT}/"])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.55"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.44:8888"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.55:8888"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.44:{HTTPSERVER_PORT}"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.55:{HTTPSERVER_PORT}"])
 
     # sslcert with in-scope chain
     events, all_events, all_events_nodups, graph_output_events, graph_output_batch_events = await do_scan(
-        "127.0.0.0/31", modules=["sslcert"], _config={"scope": {"report_distance": 0}, "speculate": True, "modules": {"speculate": {"ports": "9999"}}}, _dns_mock={"www.bbottest.notreal": {"A": ["127.0.1.0"]}, "test.notreal": {"A": ["127.0.0.1"]}}
+        "127.0.0.0/31", modules=["sslcert"], _config={"scope": {"report_distance": 0}, "speculate": True, "modules": {"speculate": {"ports": f"{HTTPSERVER_SSL_PORT}"}}}, _dns_mock={"www.bbottest.notreal": {"A": ["127.0.1.0"]}, "test.notreal": {"A": ["127.0.0.1"]}}
     )
 
     # sslcert now watches HTTP_RESPONSE, which auto-enables the http module.
@@ -677,68 +692,68 @@ def custom_setup(scan):
     assert 1 == len([e for e in events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
     assert 1 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1"])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:9999"])
-    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:9999"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_SSL_PORT}"])
+    assert 1 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_SSL_HOSTPORT])
     assert 1 == len([e for e in events if e.type == "HTTP_RESPONSE" and str(e.module) == "http"])
     assert 1 == len([e for e in events if e.type == "URL" and str(e.module) == "http"])
     assert 1 == len([e for e in events if e.type == "URL_UNVERIFIED" and str(e.module) == "speculate"])
     assert 1 == len([e for e in events if e.type == "DNS_NAME" and e.data == "test.notreal" and e.internal is False and e.scope_distance == 0 and str(e.module) == "sslcert"])
     assert 1 == len([e for e in events if e.type == "DNS_NAME" and e.data == "www.bbottest.notreal" and e.internal is False and e.scope_distance == 1 and str(e.module) == "sslcert" and "affiliate" in e.tags])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "test.notreal:9999"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"test.notreal:{HTTPSERVER_SSL_PORT}"])
     assert 0 == len([e for e in events if e.type == "DNS_NAME_UNRESOLVED" and e.data == "notreal"])
 
     assert len(all_events) == 16
     assert 1 == len([e for e in all_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 0])
     assert 2 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:9999" and e.internal is True and e.scope_distance == 0])
-    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:9999" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_SSL_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 2 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_SSL_HOSTPORT and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events if e.type == "HTTP_RESPONSE" and str(e.module) == "http"])
     assert 1 == len([e for e in all_events if e.type == "URL" and str(e.module) == "http"])
     assert 1 == len([e for e in all_events if e.type == "URL_UNVERIFIED" and str(e.module) == "speculate"])
     assert 1 == len([e for e in all_events if e.type == "DNS_NAME" and e.data == "test.notreal" and e.internal is False and e.scope_distance == 0 and str(e.module) == "sslcert"])
     assert 1 == len([e for e in all_events if e.type == "DNS_NAME" and e.data == "www.bbottest.notreal" and e.internal is False and e.scope_distance == 1 and str(e.module) == "sslcert"])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "www.bbottest.notreal:9999" and e.internal is True and e.scope_distance == 1 and str(e.module) == "speculate"])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"www.bbottest.notreal:{HTTPSERVER_SSL_PORT}" and e.internal is True and e.scope_distance == 1 and str(e.module) == "speculate"])
     assert 1 == len([e for e in all_events if e.type == "DNS_NAME_UNRESOLVED" and e.data == "bbottest.notreal" and e.internal is True and e.scope_distance == 2 and str(e.module) == "speculate"])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "test.notreal:9999" and e.internal is True and e.scope_distance == 0 and str(e.module) == "speculate"])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"test.notreal:{HTTPSERVER_SSL_PORT}" and e.internal is True and e.scope_distance == 0 and str(e.module) == "speculate"])
 
     assert len(all_events_nodups) == 14
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:9999" and e.internal is True and e.scope_distance == 0])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:9999" and e.internal is False and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_SSL_PORT}" and e.internal is True and e.scope_distance == 0])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_SSL_HOSTPORT and e.internal is False and e.scope_distance == 0])
     assert 1 == len([e for e in all_events_nodups if e.type == "HTTP_RESPONSE" and str(e.module) == "http"])
     assert 1 == len([e for e in all_events_nodups if e.type == "URL" and str(e.module) == "http"])
     assert 1 == len([e for e in all_events_nodups if e.type == "URL_UNVERIFIED" and str(e.module) == "speculate"])
     assert 1 == len([e for e in all_events_nodups if e.type == "DNS_NAME" and e.data == "test.notreal" and e.internal is False and e.scope_distance == 0 and str(e.module) == "sslcert"])
     assert 1 == len([e for e in all_events_nodups if e.type == "DNS_NAME" and e.data == "www.bbottest.notreal" and e.internal is False and e.scope_distance == 1 and str(e.module) == "sslcert"])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "www.bbottest.notreal:9999" and e.internal is True and e.scope_distance == 1 and str(e.module) == "speculate"])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"www.bbottest.notreal:{HTTPSERVER_SSL_PORT}" and e.internal is True and e.scope_distance == 1 and str(e.module) == "speculate"])
     assert 1 == len([e for e in all_events_nodups if e.type == "DNS_NAME_UNRESOLVED" and e.data == "bbottest.notreal" and e.internal is True and e.scope_distance == 2 and str(e.module) == "speculate"])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "test.notreal:9999" and e.internal is True and e.scope_distance == 0 and str(e.module) == "speculate"])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"test.notreal:{HTTPSERVER_SSL_PORT}" and e.internal is True and e.scope_distance == 0 and str(e.module) == "speculate"])
 
     for _graph_output_events in (graph_output_events, graph_output_batch_events):
         assert len(_graph_output_events) == 10
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 0])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is False and e.scope_distance == 0])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:9999"])
-        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:9999" and e.internal is False and e.scope_distance == 0])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_SSL_PORT}"])
+        assert 1 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_SSL_HOSTPORT and e.internal is False and e.scope_distance == 0])
         assert 1 == len([e for e in _graph_output_events if e.type == "HTTP_RESPONSE" and str(e.module) == "http"])
         assert 1 == len([e for e in _graph_output_events if e.type == "URL" and str(e.module) == "http"])
         assert 1 == len([e for e in _graph_output_events if e.type == "URL_UNVERIFIED" and str(e.module) == "speculate"])
         assert 1 == len([e for e in _graph_output_events if e.type == "DNS_NAME" and e.data == "test.notreal" and e.internal is False and e.scope_distance == 0 and str(e.module) == "sslcert"])
         assert 1 == len([e for e in _graph_output_events if e.type == "DNS_NAME" and e.data == "www.bbottest.notreal" and e.internal is False and e.scope_distance == 1 and str(e.module) == "sslcert"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "www.bbottest.notreal:9999"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"www.bbottest.notreal:{HTTPSERVER_SSL_PORT}"])
         assert 0 == len([e for e in _graph_output_events if e.type == "DNS_NAME_UNRESOLVED" and e.data == "bbottest.notreal"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "test.notreal:9999"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"test.notreal:{HTTPSERVER_SSL_PORT}"])
 
     # sslcert with out-of-scope chain
     events, all_events, all_events_nodups, graph_output_events, graph_output_batch_events = await do_scan(
         "127.0.1.0",
         seeds=["127.0.0.0/31"],
         modules=["sslcert"],
-        _config={"scope": {"search_distance": 1, "report_distance": 0}, "speculate": True, "modules": {"speculate": {"ports": "9999"}}},
+        _config={"scope": {"search_distance": 1, "report_distance": 0}, "speculate": True, "modules": {"speculate": {"ports": f"{HTTPSERVER_SSL_PORT}"}}},
         _dns_mock={"www.bbottest.notreal": {"A": ["127.0.0.1"]}, "test.notreal": {"A": ["127.0.1.0"]}},
     )
 
@@ -748,36 +763,36 @@ def custom_setup(scan):
     assert 1 == len([e for e in events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 1])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
     assert 0 == len([e for e in events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1"])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:9999"])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:9999"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_SSL_PORT}"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_SSL_HOSTPORT])
     assert 0 == len([e for e in events if e.type == "DNS_NAME" and e.data == "test.notreal"])
     assert 0 == len([e for e in events if e.type == "DNS_NAME" and e.data == "www.bbottest.notreal"])
-    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == "test.notreal:9999"])
+    assert 0 == len([e for e in events if e.type == "OPEN_TCP_PORT" and e.data == f"test.notreal:{HTTPSERVER_SSL_PORT}"])
 
     assert len(all_events) == 6
     assert 1 == len([e for e in all_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 1])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 2])
     assert 1 == len([e for e in all_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:9999" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:9999" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_SSL_PORT}" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_SSL_HOSTPORT and e.internal is True and e.scope_distance == 2])
 
     assert len(all_events_nodups) == 6
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 1])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.0" and e.internal is True and e.scope_distance == 2])
     assert 1 == len([e for e in all_events_nodups if e.type == "IP_ADDRESS" and e.data == "127.0.0.1" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:9999" and e.internal is True and e.scope_distance == 2])
-    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:9999" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_SSL_PORT}" and e.internal is True and e.scope_distance == 2])
+    assert 1 == len([e for e in all_events_nodups if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_SSL_HOSTPORT and e.internal is True and e.scope_distance == 2])
 
     for _graph_output_events in (graph_output_events, graph_output_batch_events):
         assert len(_graph_output_events) == 3
         assert 1 == len([e for e in _graph_output_events if e.type == "IP_RANGE" and e.data == "127.0.0.0/31" and e.internal is False and e.scope_distance == 1])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.0"])
         assert 0 == len([e for e in _graph_output_events if e.type == "IP_ADDRESS" and e.data == "127.0.0.1"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.0:9999"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "127.0.0.1:9999"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"127.0.0.0:{HTTPSERVER_SSL_PORT}"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == HTTPSERVER_SSL_HOSTPORT])
         assert 0 == len([e for e in _graph_output_events if e.type == "DNS_NAME" and e.data == "test.notreal"])
         assert 0 == len([e for e in _graph_output_events if e.type == "DNS_NAME" and e.data == "www.bbottest.notreal"])
-        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == "test.notreal:9999"])
+        assert 0 == len([e for e in _graph_output_events if e.type == "OPEN_TCP_PORT" and e.data == f"test.notreal:{HTTPSERVER_SSL_PORT}"])
 
 
 @pytest.mark.asyncio
@@ -786,7 +801,7 @@ async def test_manager_blacklist(bbot_scanner, bbot_httpserver, caplog):
     bbot_httpserver.expect_request(uri="/").respond_with_data(response_data="<a href='http://www-prod.test.notreal:8888'/><a href='http://www-dev.test.notreal:8888'/>")
 
     # dns search distance = 1, report distance = 0
-    scan = bbot_scanner("127.0.0.0/29", "test.notreal", seeds=["http://127.0.0.1:8888"], modules=["http"], config={"excavate": True, "dns": {"minimal": False, "search_distance": 1}, "scope": {"report_distance": 0}}, blacklist=["127.0.0.64/29"])
+    scan = bbot_scanner("127.0.0.0/29", "test.notreal", seeds=[HTTPSERVER_URL], modules=["http"], config={"excavate": True, "dns": {"minimal": False, "search_distance": 1}, "scope": {"report_distance": 0}}, blacklist=["127.0.0.64/29"])
     await scan._prep()
     await scan.helpers.dns._mock_dns({"www-prod.test.notreal": {"A": ["127.0.0.66"]}, "www-dev.test.notreal": {"A": ["127.0.0.22"]}})
 
@@ -835,13 +850,13 @@ async def test_scope_accuracy_with_special_urls(bbot_scanner, bbot_httpserver):
     was causing special URLs to be rejected by critical internal modules like `_scan_egress`, leading to the output of unwanted URLs.
     """
     bbot_httpserver.expect_request(uri="/v2/users/spacex").respond_with_data(response_data="")
-    bbot_httpserver.expect_request(uri="/u/spacex").respond_with_data(response_data="<a href='http://127.0.0.1:8888/asdf.js'/>")
+    bbot_httpserver.expect_request(uri="/u/spacex").respond_with_data(response_data=f"<a href='{HTTPSERVER_URL}/asdf.js'/>")
 
     scan = bbot_scanner("ORG:spacex", modules=["http", "social", "dockerhub"], config={"speculate": True, "excavate": True})
 
     await scan._prep()
-    scan.modules["dockerhub"].site_url = "http://127.0.0.1:8888"
-    scan.modules["dockerhub"].api_url = "http://127.0.0.1:8888/v2"
+    scan.modules["dockerhub"].site_url = HTTPSERVER_URL
+    scan.modules["dockerhub"].api_url = f"{HTTPSERVER_URL}/v2"
 
     async def mock_wildcard(*args, **kwargs):
         return False
@@ -868,7 +883,7 @@ async def handle_event(self, event):
 
     # there are actually 2 URL events. They are both from the same URL, but one was extracted by the full URL regex, and the other by the src/href= regex.
     # however, they should be deduped by scan_ingress.
-    bad_url_events = [e for e in dummy_module.events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/asdf.js"]
+    bad_url_events = [e for e in dummy_module.events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/asdf.js"]
     assert len(bad_url_events) == 1
     # they should both be internal
     assert all(e.internal is True for e in bad_url_events)
diff --git a/bbot/test/test_step_1/test_presets.py b/bbot/test/test_step_1/test_presets.py
index d1a4117866..49db7b78a8 100644
--- a/bbot/test/test_step_1/test_presets.py
+++ b/bbot/test/test_step_1/test_presets.py
@@ -4,6 +4,7 @@
 from ..bbot_fixtures import *  # noqa F401
 
 from bbot.scanner import Scanner, Preset
+from bbot.test.worker import worker_dir
 
 
 # FUTURE TODO:
@@ -819,7 +820,7 @@ def test_preset_include():
     custom_preset_dir_1 = bbot_test_dir / "custom_preset_dir"
     custom_preset_dir_2 = custom_preset_dir_1 / "preset_subdir"
     custom_preset_dir_3 = custom_preset_dir_2 / "subsubdir"
-    custom_preset_dir_4 = Path("/tmp/.bbot_preset_test")
+    custom_preset_dir_4 = worker_dir("/tmp/.bbot_preset_test")
     custom_preset_dir_5 = custom_preset_dir_4 / "subdir"
     mkdir(custom_preset_dir_1)
     mkdir(custom_preset_dir_2)
diff --git a/bbot/test/test_step_1/test_python_api.py b/bbot/test/test_step_1/test_python_api.py
index 1b3ce237fc..cb685980ea 100644
--- a/bbot/test/test_step_1/test_python_api.py
+++ b/bbot/test/test_step_1/test_python_api.py
@@ -1,5 +1,7 @@
 from ..bbot_fixtures import *
 
+from bbot.test.worker import worker_dir
+
 
 @pytest.mark.asyncio
 async def test_python_api(clean_default_config):
@@ -44,7 +46,7 @@ async def test_python_api(clean_default_config):
     assert "scan_logging_test" in open(debug_log).read()
 
     # make sure config loads properly
-    bbot_home = "/tmp/.bbot_python_api_test"
+    bbot_home = str(worker_dir("/tmp/.bbot_python_api_test"))
     scan4 = Scanner("127.0.0.1", config={"home": bbot_home})
     await scan4._prep()
     assert os.environ["BBOT_TOOLS"] == str(Path(bbot_home) / "tools")
@@ -88,7 +90,7 @@ async def test_python_api_sync(clean_default_config):
     out_file = scan2.helpers.scans_dir / "python_api_test" / "output.json"
     assert list(scan2.helpers.read_file(out_file))
     # make sure config loads properly
-    bbot_home = "/tmp/.bbot_python_api_test"
+    bbot_home = str(worker_dir("/tmp/.bbot_python_api_test"))
     scan3 = Scanner("127.0.0.1", config={"home": bbot_home})
     await scan3._prep()
     assert os.environ["BBOT_TOOLS"] == str(Path(bbot_home) / "tools")
diff --git a/bbot/test/test_step_1/test_scope.py b/bbot/test/test_step_1/test_scope.py
index 52ee4462a1..3b094e4d25 100644
--- a/bbot/test/test_step_1/test_scope.py
+++ b/bbot/test/test_step_1/test_scope.py
@@ -1,9 +1,10 @@
 from ..bbot_fixtures import *  # noqa: F401
 from ..test_step_2.module_tests.base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_PORT, HTTPSERVER_URL
 
 
 class TestScopeBaseline(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http"]
     config_overrides = {"omit_event_types": []}
 
@@ -42,7 +43,7 @@ def check(self, module_test, events):
                 for e in events
                 if e.type == "HTTP_RESPONSE"
                 and str(e.host) == "127.0.0.1"
-                and e.port == 8888
+                and e.port == HTTPSERVER_PORT
                 and e.scope_distance == 0
             ]
         )
@@ -50,7 +51,10 @@ def check(self, module_test, events):
             [
                 e
                 for e in events
-                if e.type == "URL" and str(e.host) == "127.0.0.1" and e.port == 8888 and e.scope_distance == 0
+                if e.type == "URL"
+                and str(e.host) == "127.0.0.1"
+                and e.port == HTTPSERVER_PORT
+                and e.scope_distance == 0
             ]
         )
 
diff --git a/bbot/test/test_step_1/test_target.py b/bbot/test/test_step_1/test_target.py
index 2df98df652..4a09a24372 100644
--- a/bbot/test/test_step_1/test_target.py
+++ b/bbot/test/test_step_1/test_target.py
@@ -1,4 +1,5 @@
 from ..bbot_fixtures import *  # noqa: F401
+from bbot.test.worker import HTTPSERVER_URL
 
 
 @pytest.mark.asyncio
@@ -665,26 +666,26 @@ async def test_blacklist_regex(bbot_scanner, bbot_httpserver):
     assert "http://test.com/asdf/123456.aspx" in blacklist
 
     bbot_httpserver.expect_request(uri="/").respond_with_data(
-        """
-        <a href='http://127.0.0.1:8888/asdfevil333asdf'/>
-        <a href='http://127.0.0.1:8888/logout.aspx'/>
+        f"""
+        <a href='{HTTPSERVER_URL}/asdfevil333asdf'/>
+        <a href='{HTTPSERVER_URL}/logout.aspx'/>
     """
     )
     bbot_httpserver.expect_request(uri="/asdfevilasdf").respond_with_data("")
     bbot_httpserver.expect_request(uri="/logout.aspx").respond_with_data("")
 
     # make sure URL is detected normally
-    scan = bbot_scanner("http://127.0.0.1:8888/", presets=["spider"], config={"excavate": True}, debug=True)
+    scan = bbot_scanner(f"{HTTPSERVER_URL}/", presets=["spider"], config={"excavate": True}, debug=True)
     await scan._prep()
     assert {r.pattern for r in scan.target.blacklist.blacklist_regexes} == {r"/.*(sign|log)[_-]?out"}
     events = [e async for e in scan.async_start()]
     urls = [e.url for e in events if e.type == "URL"]
     assert len(urls) == 2
-    assert set(urls) == {"http://127.0.0.1:8888/", "http://127.0.0.1:8888/asdfevil333asdf"}
+    assert set(urls) == {f"{HTTPSERVER_URL}/", f"{HTTPSERVER_URL}/asdfevil333asdf"}
 
     # same scan again but with blacklist regex
     scan = bbot_scanner(
-        "http://127.0.0.1:8888/",
+        f"{HTTPSERVER_URL}/",
         blacklist=[r"RE:evil[0-9]{3}"],
         presets=["spider"],
         config={"excavate": True},
@@ -700,7 +701,7 @@ async def test_blacklist_regex(bbot_scanner, bbot_httpserver):
     events = [e async for e in scan.async_start()]
     urls = [e.url for e in events if e.type == "URL"]
     assert len(urls) == 1
-    assert set(urls) == {"http://127.0.0.1:8888/"}
+    assert set(urls) == {f"{HTTPSERVER_URL}/"}
 
 
 def test_blacklist_get_invalid_host():
diff --git a/bbot/test/test_step_1/test_web.py b/bbot/test/test_step_1/test_web.py
index d3a0a7bdf6..530cc66b97 100644
--- a/bbot/test/test_step_1/test_web.py
+++ b/bbot/test/test_step_1/test_web.py
@@ -4,6 +4,8 @@
 
 from ..bbot_fixtures import *
 
+from bbot.test.worker import BBOT_TEST_DIR
+
 
 @pytest.mark.asyncio
 async def test_web(bbot_scanner, bbot_httpserver, blasthttp_mock):
@@ -204,7 +206,7 @@ async def test_web_helpers(bbot_scanner, bbot_httpserver, blasthttp_mock):
     assert scan1.helpers.is_cached(url)
     with open(filename) as f:
         assert f.read() == download_content
-    filename = Path("/tmp/bbot_download_test_file")
+    filename = BBOT_TEST_DIR / "bbot_download_test_file"
     filename.unlink(missing_ok=True)
     filename2 = await scan1.helpers.download(url, filename=filename)
     assert filename2 == filename
diff --git a/bbot/test/test_step_1/test_worker_count.py b/bbot/test/test_step_1/test_worker_count.py
new file mode 100644
index 0000000000..e6c50f231f
--- /dev/null
+++ b/bbot/test/test_step_1/test_worker_count.py
@@ -0,0 +1,81 @@
+from unittest.mock import patch
+
+from bbot.test.worker_count import RESERVE_MB, MB_PER_WORKER, cpu_count, worker_count
+
+
+def _sysconf(total_mb):
+    def inner(name):
+        if name == "SC_PAGE_SIZE":
+            return 4096
+        if name == "SC_PHYS_PAGES":
+            return total_mb * 1024 * 1024 // 4096
+        raise ValueError(name)
+
+    return inner
+
+
+def test_worker_count_env_override_wins():
+    with patch.dict("os.environ", {"BBOT_TEST_WORKERS": "3"}):
+        assert worker_count() == 3
+    with patch.dict("os.environ", {"BBOT_TEST_WORKERS": "999"}):
+        assert worker_count() == 999
+
+
+def test_worker_count_env_override_is_sanitized():
+    with patch.dict("os.environ", {"BBOT_TEST_WORKERS": "  4  "}):
+        assert worker_count() == 4
+    for bogus in ("0", "-1"):
+        with patch.dict("os.environ", {"BBOT_TEST_WORKERS": bogus}):
+            assert worker_count() == 1
+
+
+def test_worker_count_ignores_blank_override():
+    with patch.dict("os.environ", {"BBOT_TEST_WORKERS": "   "}):
+        with patch("bbot.test.worker_count.cpu_count", return_value=4):
+            with patch("os.sysconf", _sysconf(RESERVE_MB + 4 * MB_PER_WORKER)):
+                assert worker_count() == 4
+
+
+def test_worker_count_is_capped_by_memory():
+    total = RESERVE_MB + 2 * MB_PER_WORKER
+    with patch.dict("os.environ", {}, clear=True):
+        with patch("bbot.test.worker_count.cpu_count", return_value=64):
+            with patch("os.sysconf", _sysconf(total)):
+                assert worker_count() == 2
+
+
+def test_worker_count_is_capped_by_cores():
+    with patch.dict("os.environ", {}, clear=True):
+        with patch("bbot.test.worker_count.cpu_count", return_value=4):
+            with patch("os.sysconf", _sysconf(RESERVE_MB + 64 * MB_PER_WORKER)):
+                assert worker_count() == 4
+
+
+def test_worker_count_never_returns_zero_on_small_machines():
+    with patch.dict("os.environ", {}, clear=True):
+        with patch("bbot.test.worker_count.cpu_count", return_value=8):
+            for total in (RESERVE_MB // 2, RESERVE_MB, RESERVE_MB + 1):
+                with patch("os.sysconf", _sysconf(total)):
+                    assert worker_count() == 1
+
+
+def test_worker_count_falls_back_to_cpus_when_memory_unknown():
+    for exc in (ValueError, OSError, AttributeError):
+        with patch.dict("os.environ", {}, clear=True):
+            with patch("bbot.test.worker_count.cpu_count", return_value=6):
+                with patch("os.sysconf", side_effect=exc):
+                    assert worker_count() == 6
+
+
+def test_cpu_count_prefers_affinity():
+    with patch("os.sched_getaffinity", return_value={0, 1}):
+        assert cpu_count() == 2
+
+
+def test_cpu_count_falls_back_without_affinity():
+    with patch("os.sched_getaffinity", side_effect=AttributeError):
+        with patch("os.cpu_count", return_value=12):
+            assert cpu_count() == 12
+    with patch("os.sched_getaffinity", side_effect=AttributeError):
+        with patch("os.cpu_count", return_value=None):
+            assert cpu_count() == 1
diff --git a/bbot/test/test_step_1/test_worker_isolation.py b/bbot/test/test_step_1/test_worker_isolation.py
new file mode 100644
index 0000000000..d7d887c583
--- /dev/null
+++ b/bbot/test/test_step_1/test_worker_isolation.py
@@ -0,0 +1,85 @@
+from pathlib import Path
+from unittest.mock import patch
+
+from bbot.test.worker import (
+    BASE_BBOT_TEST_DIR,
+    WORKER_PORT_STRIDE,
+    _worker_index,
+    worker_dir,
+    worker_id,
+    worker_port,
+)
+
+
+def _env(value):
+    if value is None:
+        return patch.dict("os.environ", {}, clear=True)
+    return patch.dict("os.environ", {"PYTEST_XDIST_WORKER": value})
+
+
+def test_worker_id_serial_is_empty():
+    with _env(None):
+        assert worker_id() == ""
+
+
+def test_worker_id_recognizes_gw_workers():
+    for name in ("gw0", "gw1", "gw15"):
+        with _env(name):
+            assert worker_id() == name
+
+
+def test_worker_id_rejects_non_gw_values():
+    for name in ("master", "", "controller"):
+        with _env(name):
+            assert worker_id() == ""
+
+
+def test_worker_index_parses_the_number():
+    for name, expected in (("gw0", 0), ("gw1", 1), ("gw15", 15)):
+        with _env(name):
+            assert _worker_index() == expected
+
+
+def test_worker_index_defaults_to_zero():
+    with _env(None):
+        assert _worker_index() == 0
+    with _env("gwX"):
+        assert _worker_index() == 0
+
+
+def test_worker_port_is_unchanged_when_serial():
+    with _env(None):
+        assert worker_port(8888) == 8888
+
+
+def test_worker_port_blocks_do_not_overlap():
+    bases = [8888, 9999, 5556, 8978, 8765]
+    seen = {}
+    for i in range(16):
+        with _env(f"gw{i}"):
+            for base in bases:
+                port = worker_port(base)
+                assert port not in seen, f"port {port} collides: gw{i}/{base} vs {seen[port]}"
+                seen[port] = f"gw{i}/{base}"
+
+
+def test_worker_port_uses_the_stride():
+    with _env("gw3"):
+        assert worker_port(8888) == 8888 + 3 * WORKER_PORT_STRIDE
+
+
+def test_worker_dir_is_unchanged_when_serial():
+    with _env(None):
+        assert worker_dir() == BASE_BBOT_TEST_DIR
+        assert worker_dir("/tmp/.bbot_example") == Path("/tmp/.bbot_example")
+
+
+def test_worker_dir_is_unique_per_worker():
+    seen = set()
+    for i in range(16):
+        with _env(f"gw{i}"):
+            d = worker_dir()
+            assert d not in seen
+            seen.add(d)
+    with _env("gw2"):
+        assert worker_dir("/tmp/.bbot_example") == Path("/tmp/.bbot_example_gw2")
diff --git a/bbot/test/test_step_2/module_tests/test_module_ajaxpro.py b/bbot/test/test_step_2/module_tests/test_module_ajaxpro.py
index 21c44f8519..1c3fb4dc9f 100644
--- a/bbot/test/test_step_2/module_tests/test_module_ajaxpro.py
+++ b/bbot/test/test_step_2/module_tests/test_module_ajaxpro.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestAjaxpro(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "ajaxpro"]
     exploit_headers = {"X-Ajaxpro-Method": "AddItem", "Content-Type": "text/json; charset=UTF-8"}
     exploit_response = """
@@ -37,8 +38,7 @@ def check(self, module_test, events):
             if (
                 e.type == "FINDING"
                 and "Ajaxpro Deserialization RCE (CVE-2021-23758)" in e.data["description"]
-                and "http://127.0.0.1:8888/ajaxpro/AjaxPro.Services.ICartService,AjaxPro.2.ashx"
-                in e.data["description"]
+                and f"{HTTPSERVER_URL}/ajaxpro/AjaxPro.Services.ICartService,AjaxPro.2.ashx" in e.data["description"]
             ):
                 ajaxpro_exploit_detection = True
 
diff --git a/bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py b/bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py
index 2af603865f..b51f6fc97a 100644
--- a/bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py
+++ b/bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py
@@ -1,5 +1,6 @@
 from .base import ModuleTestBase
 import re
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestAspnetBinExposure(ModuleTestBase):
@@ -11,7 +12,7 @@ class TestAspnetBinExposure(ModuleTestBase):
     assertion on the Detection Url pattern would fail.
     """
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "aspnet_bin_exposure"]
 
     async def setup_before_prep(self, module_test):
@@ -52,7 +53,7 @@ def check(self, module_test, events):
 class TestAspnetBinExposure_DeadHost(ModuleTestBase):
     """Dead host returns 404 for everything -- no FINDING should be emitted."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "aspnet_bin_exposure"]
 
     async def setup_before_prep(self, module_test):
@@ -68,7 +69,7 @@ def check(self, module_test, events):
 class TestAspnetBinExposure_FalsePositive(ModuleTestBase):
     """Host serves DLLs for everything (including the fake DLL) -- no FINDING should be emitted."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "aspnet_bin_exposure"]
 
     async def setup_before_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_asset_inventory.py b/bbot/test/test_step_2/module_tests/test_module_asset_inventory.py
index 39aca71341..c066832bea 100644
--- a/bbot/test/test_step_2/module_tests/test_module_asset_inventory.py
+++ b/bbot/test/test_step_2/module_tests/test_module_asset_inventory.py
@@ -1,13 +1,16 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_SSL_HOSTPORT, HTTPSERVER_SSL_PORT
 
 
 class TestAsset_Inventory(ModuleTestBase):
     targets = ["127.0.0.1", "bbottest.notreal"]
     scan_name = "asset_inventory_test"
-    config_overrides = {"dns": {"minimal": False}, "modules": {"portscan": {"ports": "9999"}}}
+    config_overrides = {"dns": {"minimal": False}, "modules": {"portscan": {"ports": f"{HTTPSERVER_SSL_PORT}"}}}
     modules_overrides = ["asset_inventory", "portscan", "sslcert"]
 
-    masscan_output = """{   "ip": "127.0.0.1",   "timestamp": "1680197558", "ports": [ {"port": 9999, "proto": "tcp", "status": "open", "reason": "syn-ack", "ttl": 54} ] }"""
+    # Mocked masscan output. The port here is what the module "discovers", so it
+    # has to match the port the assertions expect, which moves per xdist worker.
+    masscan_output = f"""{{   "ip": "127.0.0.1",   "timestamp": "1680197558", "ports": [ {{"port": {HTTPSERVER_SSL_PORT}, "proto": "tcp", "status": "open", "reason": "syn-ack", "ttl": 54}} ] }}"""
 
     async def setup_after_prep(self, module_test):
         async def run_masscan(command, *args, **kwargs):
@@ -32,7 +35,7 @@ async def run_masscan(command, *args, **kwargs):
         )
 
     def check(self, module_test, events):
-        assert any(e.data == "127.0.0.1:9999" for e in events), "No open port found"
+        assert any(e.data == HTTPSERVER_SSL_HOSTPORT for e in events), "No open port found"
         assert any(e.data == "www.bbottest.notreal" for e in events), "No DNS name found"
         filename = next(module_test.scan.home.glob("asset-inventory.csv"))
         with open(filename) as f:
@@ -51,8 +54,21 @@ class TestAsset_InventoryEmitPrevious(TestAsset_Inventory):
     config_overrides = {"dns": {"minimal": False}, "modules": {"asset_inventory": {"use_previous": True}}}
     modules_overrides = ["asset_inventory"]
 
+    async def setup_before_prep(self, module_test):
+        await super().setup_before_prep(module_test)
+        # use_previous=True reads the asset-inventory.csv left behind by a
+        # prior scan of the same name. Relying on TestAsset_Inventory to have
+        # produced it makes this test order-dependent, which does not survive
+        # xdist: sibling tests can run in any order, and on any worker. Seed
+        # the file instead so the test stands on its own.
+        scan_home = module_test.scan.home
+        scan_home.mkdir(parents=True, exist_ok=True)
+        with open(scan_home / "asset-inventory.csv", "w") as f:
+            f.write("Host,Provider,IP(s),Status,Open Ports,Risk Rating,Findings,Description\n")
+            f.write(f"www.bbottest.notreal,,127.0.0.1,Active,{HTTPSERVER_SSL_PORT},,,\n")
+
     def check(self, module_test, events):
-        assert any(e.data == "www.bbottest.notreal:9999" for e in events), "No open port found"
+        assert any(e.data == f"www.bbottest.notreal:{HTTPSERVER_SSL_PORT}" for e in events), "No open port found"
         assert any(e.data == "www.bbottest.notreal" for e in events), "No DNS name found"
         filename = next(module_test.scan.home.glob("asset-inventory.csv"))
         with open(filename) as f:
diff --git a/bbot/test/test_step_2/module_tests/test_module_baddns.py b/bbot/test/test_step_2/module_tests/test_module_baddns.py
index ecda4f8824..2ef77da8df 100644
--- a/bbot/test/test_step_2/module_tests/test_module_baddns.py
+++ b/bbot/test/test_step_2/module_tests/test_module_baddns.py
@@ -7,6 +7,7 @@
 from bbot.modules.baddns import SUBMODULE_MAX_SEVERITY, SUBMODULE_MAX_CONFIDENCE
 
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_HOSTPORT, HTTPSERVER_PORT
 
 
 def _extract_finding_values(module_cls):
@@ -183,7 +184,7 @@ def check(self, module_test, events):
 
 
 class TestBaddns_cname_signature(BaseTestBaddns):
-    targets = ["bad.dns:8888"]
+    targets = [f"bad.dns:{HTTPSERVER_PORT}"]
     modules_overrides = ["baddns", "speculate"]
 
     async def setup_after_prep(self, module_test):
@@ -192,7 +193,7 @@ async def setup_after_prep(self, module_test):
         from baddns.lib.whoismanager import WhoisManager
 
         def set_target(self, target):
-            return "127.0.0.1:8888"
+            return HTTPSERVER_HOSTPORT
 
         expect_args = {"method": "GET", "uri": "/"}
         respond_args = {"response_data": "<h1>Oops! We couldn&#8217;t find that page.</h1>", "status": 200}
diff --git a/bbot/test/test_step_2/module_tests/test_module_baddns_direct.py b/bbot/test/test_step_2/module_tests/test_module_baddns_direct.py
index cbf1a8c2d4..d99f39c00a 100644
--- a/bbot/test/test_step_2/module_tests/test_module_baddns_direct.py
+++ b/bbot/test/test_step_2/module_tests/test_module_baddns_direct.py
@@ -1,5 +1,6 @@
 from .base import ModuleTestBase
 from bbot.modules.base import BaseModule
+from bbot.test.worker import HTTPSERVER_HOSTPORT, HTTPSERVER_PORT
 
 
 class BaseTestBaddns(ModuleTestBase):
@@ -9,7 +10,7 @@ class BaseTestBaddns(ModuleTestBase):
 
 
 class TestBaddns_direct_cloudflare(BaseTestBaddns):
-    targets = ["bad.dns:8888"]
+    targets = [f"bad.dns:{HTTPSERVER_PORT}"]
     modules_overrides = ["baddns_direct"]
 
     async def dispatchWHOIS(self):
@@ -24,7 +25,7 @@ async def handle_event(self, event):
             if event.data == "bad.dns":
                 await self.helpers.sleep(0.5)
                 self.events_seen.append(event.data)
-                url = "http://bad.dns:8888/"
+                url = f"http://bad.dns:{HTTPSERVER_PORT}/"
                 url_event = self.scan.make_event(
                     url, "URL", parent=self.scan.root_event, tags=["cloudflare", "in-scope", "status-401"]
                 )
@@ -36,7 +37,7 @@ async def setup_after_prep(self, module_test):
         from baddns.lib.whoismanager import WhoisManager
 
         def set_target(self, target):
-            return "127.0.0.1:8888"
+            return HTTPSERVER_HOSTPORT
 
         self.module_test = module_test
 
diff --git a/bbot/test/test_step_2/module_tests/test_module_badsecrets.py b/bbot/test/test_step_2/module_tests/test_module_badsecrets.py
index f0c88b49cd..3a825262b1 100644
--- a/bbot/test/test_step_2/module_tests/test_module_badsecrets.py
+++ b/bbot/test/test_step_2/module_tests/test_module_badsecrets.py
@@ -1,13 +1,14 @@
 from .base import ModuleTestBase, tempwordlist
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestBadSecrets(ModuleTestBase):
     targets = [
-        "http://127.0.0.1:8888/",
-        "http://127.0.0.1:8888/test.aspx",
-        "http://127.0.0.1:8888/cookie.aspx",
-        "http://127.0.0.1:8888/cookie2.aspx",
-        "http://127.0.0.1:8888/cookie3.aspx",
+        f"{HTTPSERVER_URL}/",
+        f"{HTTPSERVER_URL}/test.aspx",
+        f"{HTTPSERVER_URL}/cookie.aspx",
+        f"{HTTPSERVER_URL}/cookie2.aspx",
+        f"{HTTPSERVER_URL}/cookie3.aspx",
     ]
 
     sample_viewstate = """
@@ -137,9 +138,9 @@ class TestBadSecrets_JWTIdentifyOnly(ModuleTestBase):
     while still emitting SecretFound findings for vulnerable JWTs."""
 
     targets = [
-        "http://127.0.0.1:8888/",
-        "http://127.0.0.1:8888/vuln_jwt.aspx",
-        "http://127.0.0.1:8888/safe_jwt.aspx",
+        f"{HTTPSERVER_URL}/",
+        f"{HTTPSERVER_URL}/vuln_jwt.aspx",
+        f"{HTTPSERVER_URL}/safe_jwt.aspx",
     ]
     modules_overrides = ["badsecrets", "http"]
 
diff --git a/bbot/test/test_step_2/module_tests/test_module_bucket_amazon.py b/bbot/test/test_step_2/module_tests/test_module_bucket_amazon.py
index 94e6140df2..a10fabb9de 100644
--- a/bbot/test/test_step_2/module_tests/test_module_bucket_amazon.py
+++ b/bbot/test/test_step_2/module_tests/test_module_bucket_amazon.py
@@ -2,6 +2,7 @@
 
 from .base import ModuleTestBase
 from bbot.core.helpers.misc import rand_string
+from bbot.test.worker import HTTPSERVER_URL
 
 __all__ = ["random_bucket_name_1", "random_bucket_name_2", "random_bucket_name_3", "Bucket_Amazon_Base"]
 
@@ -14,7 +15,7 @@
 
 
 class Bucket_Amazon_Base(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     provider = "amazon"
 
     random_bucket_1 = f"{random_bucket_name_1}.s3.amazonaws.com"
diff --git a/bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py b/bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py
index 5fae2d25bd..9ada56e702 100644
--- a/bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py
+++ b/bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py
@@ -1,9 +1,10 @@
 from .base import ModuleTestBase
 from bbot.test.bbot_fixtures import bbot_test_dir
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestBucket_File_Enum(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["bucket_file_enum", "filedownload", "http", "excavate", "cloudcheck"]
 
     download_dir = bbot_test_dir / "test_bucket_file_enum"
diff --git a/bbot/test/test_step_2/module_tests/test_module_bypass403.py b/bbot/test/test_step_2/module_tests/test_module_bypass403.py
index a78fec4c40..839794f10d 100644
--- a/bbot/test/test_step_2/module_tests/test_module_bypass403.py
+++ b/bbot/test/test_step_2/module_tests/test_module_bypass403.py
@@ -1,9 +1,10 @@
 import re
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestBypass403(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/test"]
+    targets = [f"{HTTPSERVER_URL}/test"]
     modules_overrides = ["bypass403", "http"]
 
     async def setup_after_prep(self, module_test):
@@ -16,11 +17,11 @@ def check(self, module_test, events):
         findings = [e for e in events if e.type == "FINDING"]
         assert len(findings) == 1
         finding = findings[0]
-        assert "http://127.0.0.1:8888/test..;/" in finding.data["description"]
+        assert f"{HTTPSERVER_URL}/test..;/" in finding.data["description"]
 
 
 class TestBypass403_collapsethreshold(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/test"]
+    targets = [f"{HTTPSERVER_URL}/test"]
     modules_overrides = ["bypass403", "http"]
 
     async def setup_after_prep(self, module_test):
@@ -71,7 +72,7 @@ def check(self, module_test, events):
 
 
 class TestBypass403_aspnetcookieless(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/admin.aspx"]
+    targets = [f"{HTTPSERVER_URL}/admin.aspx"]
     modules_overrides = ["bypass403", "http"]
 
     async def setup_after_prep(self, module_test):
@@ -87,7 +88,7 @@ def check(self, module_test, events):
 
 
 class TestBypass403_waf(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/test"]
+    targets = [f"{HTTPSERVER_URL}/test"]
     modules_overrides = ["bypass403", "http"]
 
     async def setup_after_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_cloudcheck.py b/bbot/test/test_step_2/module_tests/test_module_cloudcheck.py
index 7407bc9061..196b61767d 100644
--- a/bbot/test/test_step_2/module_tests/test_module_cloudcheck.py
+++ b/bbot/test/test_step_2/module_tests/test_module_cloudcheck.py
@@ -1,10 +1,11 @@
 from .base import ModuleTestBase
 
 from bbot.scanner import Scanner
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestCloudCheck(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888", "asdf2.storage.googleapis.com"]
+    targets = [HTTPSERVER_URL, "asdf2.storage.googleapis.com"]
     modules_overrides = ["http", "excavate", "cloudcheck"]
 
     async def setup_after_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_code_repository.py b/bbot/test/test_step_2/module_tests/test_module_code_repository.py
index 20df2dfb28..772c4548ce 100644
--- a/bbot/test/test_step_2/module_tests/test_module_code_repository.py
+++ b/bbot/test/test_step_2/module_tests/test_module_code_repository.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestCodeRepository(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "code_repository"]
 
     async def setup_after_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_discord.py b/bbot/test/test_step_2/module_tests/test_module_discord.py
index 06cfa6d8f7..c60a974f67 100644
--- a/bbot/test/test_step_2/module_tests/test_module_discord.py
+++ b/bbot/test/test_step_2/module_tests/test_module_discord.py
@@ -1,10 +1,11 @@
 from bbot.test.mock_blasthttp import MockResponse
 
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestDiscord(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/cookie.aspx", "http://127.0.0.1:8888/cookie2.aspx", "foo.bar"]
+    targets = [f"{HTTPSERVER_URL}/cookie.aspx", f"{HTTPSERVER_URL}/cookie2.aspx", "foo.bar"]
     modules_overrides = ["discord", "excavate", "badsecrets", "http"]
 
     webhook_url = "https://discord.com/api/webhooks/1234/deadbeef-P-uF-asdf"
diff --git a/bbot/test/test_step_2/module_tests/test_module_docker_pull.py b/bbot/test/test_step_2/module_tests/test_module_docker_pull.py
index e0ad33548a..0840c31c00 100644
--- a/bbot/test/test_step_2/module_tests/test_module_docker_pull.py
+++ b/bbot/test/test_step_2/module_tests/test_module_docker_pull.py
@@ -3,6 +3,7 @@
 from pathlib import Path
 
 from .base import ModuleTestBase
+from bbot.test.worker import BBOT_TEST_DIR
 from bbot.test.bbot_fixtures import bbot_test_dir
 
 
@@ -412,7 +413,7 @@ async def setup_before_prep(self, module_test):
                 ],
             },
         )
-        temp_path = Path("/tmp/.bbot_test")
+        temp_path = Path(f"{BBOT_TEST_DIR}")
         tar_path = temp_path / "docker_pull_test.tar.gz"
         with tarfile.open(tar_path, "w:gz") as tar:
             file_io = io.BytesIO("This is a test file".encode())
diff --git a/bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py b/bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py
index aee30f5ca7..ff70181fd1 100644
--- a/bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py
+++ b/bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py
@@ -1,6 +1,7 @@
 import re
 from .base import ModuleTestBase
 from werkzeug.wrappers import Response
+from bbot.test.worker import HTTPSERVER_URL
 
 
 dotnetnuke_http_response = """
@@ -17,7 +18,7 @@
 
 
 class TestDotnetnuke(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "dotnetnuke"]
     config_overrides = {"interactsh_disable": "True"}
 
@@ -131,7 +132,7 @@ def extract_subdomain_tag(data):
 
 
 class TestDotnetnuke_blindssrf(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "dotnetnuke"
     modules_overrides = ["http", "dotnetnuke"]
     config_overrides = {
diff --git a/bbot/test/test_step_2/module_tests/test_module_elastic.py b/bbot/test/test_step_2/module_tests/test_module_elastic.py
index a3bc55b7a2..95cf083adc 100644
--- a/bbot/test/test_step_2/module_tests/test_module_elastic.py
+++ b/bbot/test/test_step_2/module_tests/test_module_elastic.py
@@ -1,5 +1,4 @@
 import json
-import time
 import asyncio
 import ssl
 from urllib.request import urlopen, Request
@@ -7,6 +6,7 @@
 from base64 import b64encode
 
 from .base import ModuleTestBase
+from bbot.test.worker import wait_for_container
 
 
 def _elastic_request(method, url, body=None):
@@ -57,15 +57,9 @@ async def setup_before_prep(self, module_test):
             "docker.elastic.co/elasticsearch/elasticsearch:8.16.0",
         )
 
-        # Connect to Elasticsearch with retry logic
-        while True:
-            try:
-                response = _elastic_request("GET", "https://localhost:9200/_cat/health")
-                response.read()
-                break
-            except (URLError, ConnectionError, OSError) as e:
-                self.log.verbose(f"Connection failed: {e}. Retrying...")
-                time.sleep(0.5)
+        await wait_for_container(
+            "Elasticsearch", lambda: _elastic_request("GET", "https://localhost:9200/_cat/health").read()
+        )
 
         # Ensure the index is empty
         try:
diff --git a/bbot/test/test_step_2/module_tests/test_module_excavate.py b/bbot/test/test_step_2/module_tests/test_module_excavate.py
index 9d05e0c49d..070519c16d 100644
--- a/bbot/test/test_step_2/module_tests/test_module_excavate.py
+++ b/bbot/test/test_step_2/module_tests/test_module_excavate.py
@@ -7,10 +7,11 @@
 from pathlib import Path
 import time
 import yara
+from bbot.test.worker import HTTPSERVER_PORT, HTTPSERVER_URL, LOCALHOST_URL
 
 
 class TestExcavate(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/", "test.notreal", "http://127.0.0.1:8888/subdir/links.html"]
+    targets = [f"{HTTPSERVER_URL}/", "test.notreal", f"{HTTPSERVER_URL}/subdir/links.html"]
     modules_overrides = ["excavate", "http"]
     config_overrides = {"web": {"spider_distance": 1, "spider_depth": 1}, "omit_event_types": []}
 
@@ -80,15 +81,15 @@ def check(self, module_test, events):
         assert "www8.test.notreal" in event_data
         # .js files should be emitted as URL_UNVERIFIED events (they are processed by http module which has accept_js_url=True)
         # they are seen by internal modules but not by output modules
-        assert "http://127.0.0.1:8888/a_relative.js" not in event_data
-        assert "http://127.0.0.1:8888/link_relative.js" not in event_data
-        assert "http://127.0.0.1:8888/a_relative.txt" in event_data
-        assert "http://127.0.0.1:8888/link_relative.txt" in event_data
+        assert f"{HTTPSERVER_URL}/a_relative.js" not in event_data
+        assert f"{HTTPSERVER_URL}/link_relative.js" not in event_data
+        assert f"{HTTPSERVER_URL}/a_relative.txt" in event_data
+        assert f"{HTTPSERVER_URL}/link_relative.txt" in event_data
         dummy_module_event_data = [e.pretty_string for e in module_test.scan.modules["dummy_module"].events_seen]
-        assert "http://127.0.0.1:8888/a_relative.js" in dummy_module_event_data
-        assert "http://127.0.0.1:8888/link_relative.js" in dummy_module_event_data
-        assert "http://127.0.0.1:8888/a_relative.txt" in dummy_module_event_data
-        assert "http://127.0.0.1:8888/link_relative.txt" in dummy_module_event_data
+        assert f"{HTTPSERVER_URL}/a_relative.js" in dummy_module_event_data
+        assert f"{HTTPSERVER_URL}/link_relative.js" in dummy_module_event_data
+        assert f"{HTTPSERVER_URL}/a_relative.txt" in dummy_module_event_data
+        assert f"{HTTPSERVER_URL}/link_relative.txt" in dummy_module_event_data
 
         assert "nhttps://www1.test.notreal/" not in event_data
         assert "x3dhttps://www2.test.notreal/" not in event_data
@@ -108,7 +109,7 @@ def check(self, module_test, events):
 
         assert any(
             e.type == "URL_UNVERIFIED"
-            and e.url == "http://127.0.0.1:8888/relative.html"
+            and e.url == f"{HTTPSERVER_URL}/relative.html"
             and "spider-max" not in e.tags
             and "endpoint" in e.tags
             and "extension-html" in e.tags
@@ -118,12 +119,12 @@ def check(self, module_test, events):
         )
 
         assert any(
-            e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/2/depth2.html" and "spider-max" in e.tags
+            e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/2/depth2.html" and "spider-max" in e.tags
             for e in events
         )
 
         assert any(
-            e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/distance2.html" and "spider-max" in e.tags
+            e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/distance2.html" and "spider-max" in e.tags
             for e in events
         )
 
@@ -134,7 +135,7 @@ def check(self, module_test, events):
 
 
 class TestExcavate2(TestExcavate):
-    targets = ["http://127.0.0.1:8888/", "test.notreal", "http://127.0.0.1:8888/subdir/"]
+    targets = [f"{HTTPSERVER_URL}/", "test.notreal", f"{HTTPSERVER_URL}/subdir/"]
 
     async def setup_before_prep(self, module_test):
         # root relative
@@ -169,17 +170,17 @@ def check(self, module_test, events):
         for e in events:
             if e.type == "URL_UNVERIFIED":
                 # these cases represent the desired behavior for parsing relative links
-                if e.url == "http://127.0.0.1:8888/rootrelative.html":
+                if e.url == f"{HTTPSERVER_URL}/rootrelative.html":
                     root_relative_detection = True
-                if e.url == "http://127.0.0.1:8888/subdir/pagerelative1.html":
+                if e.url == f"{HTTPSERVER_URL}/subdir/pagerelative1.html":
                     page_relative_detection_1 = True
-                if e.url == "http://127.0.0.1:8888/subdir/pagerelative2.html":
+                if e.url == f"{HTTPSERVER_URL}/subdir/pagerelative2.html":
                     page_relative_detection_2 = True
 
                 # these cases indicates that excavate parsed the relative links incorrectly
-                if e.url == "http://127.0.0.1:8888/pagerelative.html":
+                if e.url == f"{HTTPSERVER_URL}/pagerelative.html":
                     root_page_confusion_1 = True
-                if e.url == "http://127.0.0.1:8888/subdir/rootrelative.html":
+                if e.url == f"{HTTPSERVER_URL}/subdir/rootrelative.html":
                     root_page_confusion_2 = True
 
         assert root_relative_detection, "Failed to properly excavate root-relative URL"
@@ -190,21 +191,19 @@ def check(self, module_test, events):
 
 
 class TestExcavateInScopeJavascript(TestExcavate):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["excavate", "http", "badsecrets"]
 
     async def setup_before_prep(self, module_test):
         module_test.httpserver.expect_request("/").respond_with_data(
-            "<script>window.location.href = 'http://127.0.0.1:8888/script.js';</script>"
+            f"<script>window.location.href = '{HTTPSERVER_URL}/script.js';</script>"
         )
         module_test.httpserver.expect_request("/script.js").respond_with_data(
             "var = 'eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo';"
         )
 
     def check(self, module_test, events):
-        found_js_url_event = bool(
-            [e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/script.js"]
-        )
+        found_js_url_event = bool([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/script.js"])
         found_excavate_jwt_finding = bool(
             [
                 e
@@ -220,7 +219,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateRedirect(TestExcavate):
-    targets = ["http://127.0.0.1:8888/", "http://127.0.0.1:8888/relative/", "http://127.0.0.1:8888/nonhttpredirect/"]
+    targets = [f"{HTTPSERVER_URL}/", f"{HTTPSERVER_URL}/relative/", f"{HTTPSERVER_URL}/nonhttpredirect/"]
     config_overrides = {"scope": {"report_distance": 1}, "omit_event_types": []}
 
     async def setup_before_prep(self, module_test):
@@ -247,7 +246,7 @@ def check(self, module_test, events):
                 if e.type == "URL_UNVERIFIED" and e.url == "https://www.test.notreal/yep" and e.scope_distance == 1
             ]
         )
-        assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/relative/owa/"])
+        assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/relative/owa/"])
         assert 1 == len(
             [
                 e
@@ -287,19 +286,19 @@ def check(self, module_test, events):
 
 
 class TestExcavateQuerystringRemoveTrue(TestExcavate):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     config_overrides = {"url_querystring_remove": True, "url_querystring_collapse": True, "omit_event_types": []}
-    lots_of_params = """
-    <a href="http://127.0.0.1:8888/endpoint?foo=1"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=2"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=3"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=4"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=5"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=6"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=7"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=8"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=9"/>
-    <a href="http://127.0.0.1:8888/endpoint?foo=10"/>
+    lots_of_params = f"""
+    <a href="{HTTPSERVER_URL}/endpoint?foo=1"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=2"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=3"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=4"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=5"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=6"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=7"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=8"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=9"/>
+    <a href="{HTTPSERVER_URL}/endpoint?foo=10"/>
     """
 
     async def setup_before_prep(self, module_test):
@@ -307,9 +306,7 @@ async def setup_before_prep(self, module_test):
 
     def check(self, module_test, events):
         assert len([e for e in events if e.type == "URL_UNVERIFIED"]) == 2
-        assert (
-            len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/endpoint"]) == 1
-        )
+        assert len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/endpoint"]) == 1
 
 
 class TestExcavateQuerystringRemoveFalse(TestExcavateQuerystringRemoveTrue):
@@ -317,13 +314,7 @@ class TestExcavateQuerystringRemoveFalse(TestExcavateQuerystringRemoveTrue):
 
     def check(self, module_test, events):
         assert (
-            len(
-                [
-                    e
-                    for e in events
-                    if e.type == "URL_UNVERIFIED" and e.url.startswith("http://127.0.0.1:8888/endpoint?")
-                ]
-            )
+            len([e for e in events if e.type == "URL_UNVERIFIED" and e.url.startswith(f"{HTTPSERVER_URL}/endpoint?")])
             == 1
         )
 
@@ -333,47 +324,41 @@ class TestExcavateQuerystringCollapseFalse(TestExcavateQuerystringRemoveTrue):
 
     def check(self, module_test, events):
         assert (
-            len(
-                [
-                    e
-                    for e in events
-                    if e.type == "URL_UNVERIFIED" and e.url.startswith("http://127.0.0.1:8888/endpoint?")
-                ]
-            )
+            len([e for e in events if e.type == "URL_UNVERIFIED" and e.url.startswith(f"{HTTPSERVER_URL}/endpoint?")])
             == 10
         )
 
 
 class TestExcavateMaxLinksPerPage(TestExcavate):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     config_overrides = {"web": {"spider_links_per_page": 10, "spider_distance": 1}, "omit_event_types": []}
 
-    lots_of_links = """
-    <a href="http://127.0.0.1:8888/1"/>
-    <a href="http://127.0.0.1:8888/2"/>
-    <a href="http://127.0.0.1:8888/3"/>
-    <a href="http://127.0.0.1:8888/4"/>
-    <a href="http://127.0.0.1:8888/5"/>
-    <a href="http://127.0.0.1:8888/6"/>
-    <a href="http://127.0.0.1:8888/7"/>
-    <a href="http://127.0.0.1:8888/8"/>
-    <a href="http://127.0.0.1:8888/9"/>
-    <a href="http://127.0.0.1:8888/10"/>
-    <a href="http://127.0.0.1:8888/11"/>
-    <a href="http://127.0.0.1:8888/12"/>
-    <a href="http://127.0.0.1:8888/13"/>
-    <a href="http://127.0.0.1:8888/14"/>
-    <a href="http://127.0.0.1:8888/15"/>
-    <a href="http://127.0.0.1:8888/16"/>
-    <a href="http://127.0.0.1:8888/17"/>
-    <a href="http://127.0.0.1:8888/18"/>
-    <a href="http://127.0.0.1:8888/19"/>
-    <a href="http://127.0.0.1:8888/20"/>
-    <a href="http://127.0.0.1:8888/21"/>
-    <a href="http://127.0.0.1:8888/22"/>
-    <a href="http://127.0.0.1:8888/23"/>
-    <a href="http://127.0.0.1:8888/24"/>
-    <a href="http://127.0.0.1:8888/25"/>
+    lots_of_links = f"""
+    <a href="{HTTPSERVER_URL}/1"/>
+    <a href="{HTTPSERVER_URL}/2"/>
+    <a href="{HTTPSERVER_URL}/3"/>
+    <a href="{HTTPSERVER_URL}/4"/>
+    <a href="{HTTPSERVER_URL}/5"/>
+    <a href="{HTTPSERVER_URL}/6"/>
+    <a href="{HTTPSERVER_URL}/7"/>
+    <a href="{HTTPSERVER_URL}/8"/>
+    <a href="{HTTPSERVER_URL}/9"/>
+    <a href="{HTTPSERVER_URL}/10"/>
+    <a href="{HTTPSERVER_URL}/11"/>
+    <a href="{HTTPSERVER_URL}/12"/>
+    <a href="{HTTPSERVER_URL}/13"/>
+    <a href="{HTTPSERVER_URL}/14"/>
+    <a href="{HTTPSERVER_URL}/15"/>
+    <a href="{HTTPSERVER_URL}/16"/>
+    <a href="{HTTPSERVER_URL}/17"/>
+    <a href="{HTTPSERVER_URL}/18"/>
+    <a href="{HTTPSERVER_URL}/19"/>
+    <a href="{HTTPSERVER_URL}/20"/>
+    <a href="{HTTPSERVER_URL}/21"/>
+    <a href="{HTTPSERVER_URL}/22"/>
+    <a href="{HTTPSERVER_URL}/23"/>
+    <a href="{HTTPSERVER_URL}/24"/>
+    <a href="{HTTPSERVER_URL}/25"/>
     """
 
     async def setup_before_prep(self, module_test):
@@ -415,7 +400,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateURL_IP(TestExcavate):
-    targets = ["http://127.0.0.1:8888/", "127.0.0.2"]
+    targets = [f"{HTTPSERVER_URL}/", "127.0.0.2"]
 
     async def setup_before_prep(self, module_test):
         module_test.httpserver.expect_request("/").respond_with_data("SomeSMooshedDATAhttps://127.0.0.2/some/path")
@@ -463,7 +448,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateNonHttpScheme(TestExcavate):
-    targets = ["http://127.0.0.1:8888/", "test.notreal"]
+    targets = [f"{HTTPSERVER_URL}/", "test.notreal"]
 
     non_http_scheme_html = """
 
@@ -517,14 +502,14 @@ def check(self, module_test, events):
 class TestExcavateParameterExtraction(TestExcavate):
     # hunt is added as parameter extraction is only activated by one or more modules that consume WEB_PARAMETER
     modules_overrides = ["excavate", "http", "hunt"]
-    targets = ["http://127.0.0.1:8888/"]
-    parameter_extraction_html = """
+    targets = [f"{HTTPSERVER_URL}/"]
+    parameter_extraction_html = f"""
     <html>
     <head>
         <title>Get extract</title>
         <script>
-            $.get("/test", {jqueryget: "value1"});
-            $.post("/test", {jquerypost: "value2"});
+            $.get("/test", {{jqueryget: "value1"}});
+            $.post("/test", {{jquerypost: "value2"}});
         </script>
     </head>
     <body>
@@ -553,7 +538,7 @@ class TestExcavateParameterExtraction(TestExcavate):
         </form>
         <p>Links</p>
         <a href="/validPath?id=123&age=456">href</a>
-        <img src="http://127.0.0.1:8888/validPath?size=m&fit=slim">img</a>
+        <img src="{HTTPSERVER_URL}/validPath?size=m&fit=slim">img</a>
         <form class="login-form" name="change-email-form" action="/my-account/change-email" method="POST">
         <select id=blog-post-author-display name=blog-post-author-display form=blog-post-author-display-form>
         <option value=user.name selected>Name</option>
@@ -671,7 +656,7 @@ class TestExcavateSelectTagSelection(ModuleTestBase):
        selected value (the form's author chose blank as the default; preserve that intent)
     """
 
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "hunt"]
     select_extract_html = """
     <html>
@@ -752,7 +737,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_postform_noaction(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
 
     # hunt is added as parameter extraction is only activated by one or more modules that consume WEB_PARAMETER
     modules_overrides = ["http", "excavate", "hunt"]
@@ -818,7 +803,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_additionalparams(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
 
     # hunt is added as parameter extraction is only activated by one or more modules that consume WEB_PARAMETER
     modules_overrides = ["http", "excavate", "hunt"]
@@ -879,7 +864,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_getparam(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
 
     # hunt is added as parameter extraction is only activated by one or more modules that consume WEB_PARAMETER
     modules_overrides = ["http", "excavate", "hunt"]
@@ -901,7 +886,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_relativeurl(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
 
     # hunt is added as parameter extraction is only activated by one or more modules that consume WEB_PARAMETER
     modules_overrides = ["http", "excavate", "hunt"]
@@ -977,7 +962,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_json(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "paramminer_getparams"]
     config_overrides = {
         "modules": {
@@ -1009,7 +994,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_xml(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "paramminer_getparams"]
     config_overrides = {
         "modules": {
@@ -1065,7 +1050,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_inputtagnovalue(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
 
     # hunt is added as parameter extraction is only activated by one or more modules that consume WEB_PARAMETER
     modules_overrides = ["http", "excavate", "hunt"]
@@ -1087,7 +1072,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_jqueryjsonajax(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "hunt"]
     jsonajax_extract_html = """
     <html>
@@ -1141,7 +1126,7 @@ class excavateTestRule(ExcavateRule):
 
 
 class TestExcavateYara(TestExcavate):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     yara_test_html = """
     <html>
 <head>
@@ -1199,7 +1184,7 @@ class TestExcavateYaraCustom(TestExcavateYara):
 class TestExcavateYaraConfidence(ModuleTestBase):
     """Test YARA rules with confidence options."""
 
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["excavate", "http"]
 
     async def setup_before_prep(self, module_test):
@@ -1262,7 +1247,7 @@ async def handle_event(self, event):
 
     dummy_text = "<a href='/spider'>spider</a>"
     modules_overrides = ["excavate", "http"]
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     config_overrides = {"omit_event_types": []}
 
     async def setup_after_prep(self, module_test):
@@ -1276,11 +1261,11 @@ def check(self, module_test, events):
         found_url_unverified_dummy = False
         found_url_event = False
 
-        assert sorted(self.dummy_module.events_seen) == ["http://127.0.0.1:8888/", "http://127.0.0.1:8888/spider"]
+        assert sorted(self.dummy_module.events_seen) == [f"{HTTPSERVER_URL}/", f"{HTTPSERVER_URL}/spider"]
 
         for e in events:
             if e.type == "URL_UNVERIFIED":
-                if e.url == "http://127.0.0.1:8888/spider":
+                if e.url == f"{HTTPSERVER_URL}/spider":
                     if str(e.module) == "excavate" and "spider-danger" in e.tags and "spider-max" in e.tags:
                         found_url_unverified_spider_max = True
                     if (
@@ -1289,7 +1274,7 @@ def check(self, module_test, events):
                         and "spider-max" not in e.tags
                     ):
                         found_url_unverified_dummy = True
-            if e.type == "URL" and e.url == "http://127.0.0.1:8888/spider":
+            if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/spider":
                 found_url_event = True
 
         assert found_url_unverified_spider_max, "Excavate failed to find /spider link"
@@ -1298,7 +1283,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateParameterExtraction_targeturl(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/?foo=1"]
+    targets = [f"{HTTPSERVER_URL}/?foo=1"]
     modules_overrides = ["http", "excavate", "hunt"]
     config_overrides = {
         "url_querystring_remove": False,
@@ -1324,7 +1309,7 @@ def check(self, module_test, events):
 
 
 class TestExcavate_retain_querystring(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/?foo=1"]
+    targets = [f"{HTTPSERVER_URL}/?foo=1"]
     modules_overrides = ["http", "excavate", "hunt"]
     config_overrides = {
         "url_querystring_remove": False,
@@ -1371,7 +1356,7 @@ def check(self, module_test, events):
 class TestExcavate_webparameter_outofscope(ModuleTestBase):
     html_body = "<html><a class=button href='https://socialmediasite.com/send?text=foo'><a class=button href='https://outofscope.com/send?text=foo'></html>"
 
-    targets = ["http://127.0.0.1:8888", "socialmediasite.com"]
+    targets = [HTTPSERVER_URL, "socialmediasite.com"]
     modules_overrides = ["http", "excavate", "hunt"]
     config_overrides = {"interactsh_disable": True}
 
@@ -1408,7 +1393,7 @@ class TestExcavate_webparameter_ip_host(ModuleTestBase):
     scope and preventing downstream modules (like lightfuzz) from processing it.
     """
 
-    targets = ["http://localhost:8888"]
+    targets = [LOCALHOST_URL]
     modules_overrides = ["http", "excavate", "hunt"]
     config_overrides = {"interactsh_disable": True}
 
@@ -1432,7 +1417,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateHeaders(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["excavate", "http", "hunt"]
     config_overrides = {"web": {"spider_distance": 1, "spider_depth": 1}}
 
@@ -1464,7 +1449,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateRAWTEXT(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/", "test.notreal"]
+    targets = [f"{HTTPSERVER_URL}/", "test.notreal"]
     modules_overrides = ["excavate", "http", "filedownload", "kreuzberg"]
     config_overrides = {
         "scope": {"report_distance": 1},
@@ -1577,18 +1562,18 @@ def check(self, module_test, events):
         assert any(
             e.type == "FINDING"
             and "JWT" in e.data["description"]
-            and e.data["url"] == "http://127.0.0.1:8888/Test_PDF"
+            and e.data["url"] == f"{HTTPSERVER_URL}/Test_PDF"
             and e.data["host"] == "127.0.0.1"
-            and e.data["path"].endswith("http-127-0-0-1-8888-test-pdf.pdf")
+            and e.data["path"].endswith(f"http-127-0-0-1-{HTTPSERVER_PORT}-test-pdf.pdf")
             and str(e.host) == "127.0.0.1"
             for e in finding_events
         ), f"Failed to emit JWT event got {finding_events}"
         assert any(
             e.type == "FINDING"
             and "DOTNET" in e.data["description"]
-            and e.data["url"] == "http://127.0.0.1:8888/Test_PDF"
+            and e.data["url"] == f"{HTTPSERVER_URL}/Test_PDF"
             and e.data["host"] == "127.0.0.1"
-            and e.data["path"].endswith("http-127-0-0-1-8888-test-pdf.pdf")
+            and e.data["path"].endswith(f"http-127-0-0-1-{HTTPSERVER_PORT}-test-pdf.pdf")
             and str(e.host) == "127.0.0.1"
             for e in finding_events
         ), f"Failed to emit serialized event got {finding_events}"
@@ -1603,7 +1588,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateHeaders_blacklist(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["excavate", "http", "hunt"]
     config_overrides = {"web": {"spider_distance": 1, "spider_depth": 1}}
 
@@ -1640,7 +1625,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateBadURLs(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["excavate", "http", "hunt"]
     config_overrides = {"interactsh_disable": True, "scope": {"report_distance": 10}, "omit_event_types": []}
 
@@ -1668,7 +1653,7 @@ def check(self, module_test, events):
         assert "Error sanitizing event data" not in debug_log_content
 
         url_events = [e for e in events if e.type == "URL_UNVERIFIED"]
-        assert sorted([e.pretty_string for e in url_events]) == sorted(["https://ssl/", "http://127.0.0.1:8888/"])
+        assert sorted([e.pretty_string for e in url_events]) == sorted(["https://ssl/", f"{HTTPSERVER_URL}/"])
 
 
 class TestExcavateURL_InvalidPort(TestExcavate):
@@ -1686,7 +1671,7 @@ def check(self, module_test, events):
 
 
 class TestExcavateIgnorePDF(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["excavate", "http"]
 
     # body content that would normally produce findings if processed
@@ -1722,7 +1707,7 @@ class TestExcavateRedirectParameterScope(ModuleTestBase):
     distance and cause lightfuzz to fuzz external endpoints.
     """
 
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "hunt"]
 
     async def setup_before_prep(self, module_test):
@@ -1753,7 +1738,7 @@ def check(self, module_test, events):
 # response. Before the fix, this fixture produced zero WEB_PARAMETER events; after
 # it, every field must be extracted, and the work must stay fast.
 class TestExcavateGiantForm(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "hunt"]
 
     GIANT_OPTION_COUNT = 5000
@@ -1804,7 +1789,7 @@ def check(self, module_test, events):
 # skipped entirely (no partial extraction). The test asserts excavate doesn't
 # hang or OOM on a multi-hundred-KB form fixture.
 class TestExcavateGiantFormExceedsMaxBytes(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "hunt"]
 
     # Constrain max_form_bytes so we don't have to generate a literal 2 MB
@@ -1859,7 +1844,7 @@ def check(self, module_test, events):
 # Both `<form action=X method=post>` and `<form method=post action=X>` should
 # extract the form's fields.
 class TestExcavateFormAttributeOrder(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "hunt"]
 
     html = """
@@ -1888,12 +1873,12 @@ def check(self, module_test, events):
 class TestExcavateHttpWildcardSkipsUrls(ModuleTestBase):
     """On an HTTP wildcard host, excavate should suppress URL_UNVERIFIED but still extract DNS_NAMEs."""
 
-    targets = ["http://127.0.0.1:8888/", "test.notreal"]
+    targets = [f"{HTTPSERVER_URL}/", "test.notreal"]
     modules_overrides = ["excavate", "http"]
     config_overrides = {"web": {"spider_distance": 1, "spider_depth": 1}}
 
-    html_body = """
-    <a href="http://127.0.0.1:8888/should-be-suppressed">link</a>
+    html_body = f"""
+    <a href="{HTTPSERVER_URL}/should-be-suppressed">link</a>
     bare hostname: extracted.test.notreal
     """
 
@@ -1930,9 +1915,9 @@ class TestExcavateContentDedup(ModuleTestBase):
     """Verify _avoid_duplicate_content=True on excavate skips HTTP_RESPONSE events with duplicate body hashes."""
 
     targets = [
-        "http://127.0.0.1:8888/dir1/page.html",
-        "http://127.0.0.1:8888/dir2/page.html",
-        "http://127.0.0.1:8888/other/page.html",
+        f"{HTTPSERVER_URL}/dir1/page.html",
+        f"{HTTPSERVER_URL}/dir2/page.html",
+        f"{HTTPSERVER_URL}/other/page.html",
     ]
     modules_overrides = ["excavate", "http"]
     config_overrides = {"web": {"spider_distance": 0, "spider_depth": 0}, "omit_event_types": []}
@@ -1962,10 +1947,10 @@ def check(self, module_test, events):
         url_events = [e for e in events if e.type == "URL_UNVERIFIED"]
         urls = {e.url for e in url_events}
 
-        assert "http://127.0.0.1:8888/other/unique.html" in urls, "Unique page link not extracted"
+        assert f"{HTTPSERVER_URL}/other/unique.html" in urls, "Unique page link not extracted"
 
-        dir1_found = "http://127.0.0.1:8888/dir1/found.html" in urls
-        dir2_found = "http://127.0.0.1:8888/dir2/found.html" in urls
+        dir1_found = f"{HTTPSERVER_URL}/dir1/found.html" in urls
+        dir2_found = f"{HTTPSERVER_URL}/dir2/found.html" in urls
         assert dir1_found or dir2_found, "Neither duplicate page was processed"
         assert not (dir1_found and dir2_found), (
             "Both duplicate pages were processed — content dedup failed to skip the second one"
@@ -1976,8 +1961,8 @@ class TestExcavateContentDedupDisabled(ModuleTestBase):
     """Verify that with _avoid_duplicate_content=False, duplicate content on different URLs is NOT deduped."""
 
     targets = [
-        "http://127.0.0.1:8888/dir1/page.html",
-        "http://127.0.0.1:8888/dir2/page.html",
+        f"{HTTPSERVER_URL}/dir1/page.html",
+        f"{HTTPSERVER_URL}/dir2/page.html",
     ]
     modules_overrides = ["excavate", "http"]
     config_overrides = {"web": {"spider_distance": 0, "spider_depth": 0}, "omit_event_types": []}
@@ -2002,8 +1987,8 @@ def check(self, module_test, events):
         url_events = [e for e in events if e.type == "URL_UNVERIFIED"]
         urls = {e.url for e in url_events}
 
-        dir1_found = "http://127.0.0.1:8888/dir1/found.html" in urls
-        dir2_found = "http://127.0.0.1:8888/dir2/found.html" in urls
+        dir1_found = f"{HTTPSERVER_URL}/dir1/found.html" in urls
+        dir2_found = f"{HTTPSERVER_URL}/dir2/found.html" in urls
         assert dir1_found and dir2_found, (
             f"Both duplicate pages should be processed when _avoid_duplicate_content=False, "
             f"got dir1={dir1_found}, dir2={dir2_found}"
@@ -2014,9 +1999,9 @@ class TestContentDedupWithURLEvents(ModuleTestBase):
     """Verify _avoid_duplicate_content works for modules watching URL events (via body_sha256 hash)."""
 
     targets = [
-        "http://127.0.0.1:8888/page1.html",
-        "http://127.0.0.1:8888/page2.html",
-        "http://127.0.0.1:8888/different.html",
+        f"{HTTPSERVER_URL}/page1.html",
+        f"{HTTPSERVER_URL}/page2.html",
+        f"{HTTPSERVER_URL}/different.html",
     ]
     modules_overrides = ["excavate", "http"]
     config_overrides = {"web": {"spider_distance": 0, "spider_depth": 0}, "omit_event_types": []}
@@ -2055,10 +2040,10 @@ def check(self, module_test, events):
         consumer = module_test.scan.modules["url_consumer"]
         seen_urls = {e.url for e in consumer.events_seen if e.type == "URL"}
 
-        assert "http://127.0.0.1:8888/different.html" in seen_urls, "Unique URL should be processed"
+        assert f"{HTTPSERVER_URL}/different.html" in seen_urls, "Unique URL should be processed"
 
-        page1_seen = "http://127.0.0.1:8888/page1.html" in seen_urls
-        page2_seen = "http://127.0.0.1:8888/page2.html" in seen_urls
+        page1_seen = f"{HTTPSERVER_URL}/page1.html" in seen_urls
+        page2_seen = f"{HTTPSERVER_URL}/page2.html" in seen_urls
         assert page1_seen or page2_seen, "At least one duplicate-content URL should be processed"
         assert not (page1_seen and page2_seen), (
             "Both duplicate-content URLs were processed — content dedup failed for URL events"
diff --git a/bbot/test/test_step_2/module_tests/test_module_filedownload.py b/bbot/test/test_step_2/module_tests/test_module_filedownload.py
index 76be392781..4e48057e6b 100644
--- a/bbot/test/test_step_2/module_tests/test_module_filedownload.py
+++ b/bbot/test/test_step_2/module_tests/test_module_filedownload.py
@@ -1,10 +1,11 @@
 from pathlib import Path
 from .base import ModuleTestBase
 from bbot.test.bbot_fixtures import bbot_test_dir
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestFileDownload(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["filedownload", "http", "excavate", "speculate"]
     config_overrides = {
         "web": {"spider_distance": 2, "spider_depth": 2},
diff --git a/bbot/test/test_step_2/module_tests/test_module_fingerprintx.py b/bbot/test/test_step_2/module_tests/test_module_fingerprintx.py
index 286b4d3052..48b138377a 100644
--- a/bbot/test/test_step_2/module_tests/test_module_fingerprintx.py
+++ b/bbot/test/test_step_2/module_tests/test_module_fingerprintx.py
@@ -1,16 +1,17 @@
 import json
 
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_HOSTPORT, HTTPSERVER_PORT
 
 
 class TestFingerprintx(ModuleTestBase):
-    targets = ["127.0.0.1:8888"]
+    targets = [HTTPSERVER_HOSTPORT]
 
     def check(self, module_test, events):
         assert any(
             event.type == "PROTOCOL"
             and event.host == module_test.scan.helpers.make_ip_type("127.0.0.1")
-            and event.port == 8888
+            and event.port == HTTPSERVER_PORT
             and event.data["protocol"] == "HTTP"
             for event in events
         ), "HTTP protocol not detected"
diff --git a/bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py b/bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py
index 2151d6a88a..46c0910c33 100644
--- a/bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py
+++ b/bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py
@@ -3,6 +3,7 @@
 from werkzeug.wrappers import Response
 
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 def extract_subdomain_tag(data):
@@ -13,7 +14,7 @@ def extract_subdomain_tag(data):
 
 
 class TestGeneric_SSRF(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "generic_ssrf"]
     config_overrides = {
         "interactsh_disable": False,
diff --git a/bbot/test/test_step_2/module_tests/test_module_git.py b/bbot/test/test_step_2/module_tests/test_module_git.py
index 77b1bf22b3..7f482a9322 100644
--- a/bbot/test/test_step_2/module_tests/test_module_git.py
+++ b/bbot/test/test_step_2/module_tests/test_module_git.py
@@ -1,11 +1,12 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestGit(ModuleTestBase):
     targets = [
-        "http://127.0.0.1:8888/",
-        "http://127.0.0.1:8888/test/asdf",
-        "http://127.0.0.1:8888/test2",
+        f"{HTTPSERVER_URL}/",
+        f"{HTTPSERVER_URL}/test/asdf",
+        f"{HTTPSERVER_URL}/test2",
     ]
 
     modules_overrides = ["git", "http"]
@@ -29,16 +30,13 @@ async def setup_after_prep(self, module_test):
         module_test.set_expect_requests(expect_args={"uri": "/test2/.git/config"}, respond_args={"response_data": ""})
 
     def check(self, module_test, events):
+        assert any(e.type == "FINDING" and f"{HTTPSERVER_URL}/.git/config" in e.data["description"] for e in events)
         assert any(
-            e.type == "FINDING" and "http://127.0.0.1:8888/.git/config" in e.data["description"] for e in events
+            e.type == "FINDING" and f"{HTTPSERVER_URL}/test/.git/config" in e.data["description"] for e in events
         )
         assert any(
-            e.type == "FINDING" and "http://127.0.0.1:8888/test/.git/config" in e.data["description"] for e in events
-        )
-        assert any(
-            e.type == "FINDING" and "http://127.0.0.1:8888/test/asdf/.git/config" in e.data["description"]
-            for e in events
+            e.type == "FINDING" and f"{HTTPSERVER_URL}/test/asdf/.git/config" in e.data["description"] for e in events
         )
         assert not any(
-            e.type == "FINDING" and "http://127.0.0.1:8888/test2/.git/config" in e.data["description"] for e in events
+            e.type == "FINDING" and f"{HTTPSERVER_URL}/test2/.git/config" in e.data["description"] for e in events
         )
diff --git a/bbot/test/test_step_2/module_tests/test_module_git_clone.py b/bbot/test/test_step_2/module_tests/test_module_git_clone.py
index e6c2c2e1a8..45f74bb272 100644
--- a/bbot/test/test_step_2/module_tests/test_module_git_clone.py
+++ b/bbot/test/test_step_2/module_tests/test_module_git_clone.py
@@ -6,6 +6,7 @@
 from pathlib import Path
 
 from .base import ModuleTestBase
+from bbot.test.worker import BBOT_TEST_DIR, BBOT_TEST_DIR_NAME
 from bbot.test.bbot_fixtures import bbot_test_dir
 
 
@@ -162,7 +163,7 @@ async def setup_before_prep(self, module_test):
         )
 
     async def setup_after_prep(self, module_test):
-        temp_path = Path("/tmp/.bbot_test")
+        temp_path = Path(BBOT_TEST_DIR)
         shutil.rmtree(temp_path / "test_keys", ignore_errors=True)
         subprocess.run(["git", "init", "test_keys"], cwd=temp_path)
         temp_repo_path = temp_path / "test_keys"
@@ -200,7 +201,7 @@ def check(self, module_test, events):
             e
             for e in events
             if e.type == "FILESYSTEM"
-            and "git_repos/.bbot_test/test_keys" in e.data["path"]
+            and f"git_repos/{BBOT_TEST_DIR_NAME}/test_keys" in e.data["path"]
             and "git" in e.tags
             and e.scope_distance == 1
         ]
diff --git a/bbot/test/test_step_2/module_tests/test_module_gitdumper.py b/bbot/test/test_step_2/module_tests/test_module_gitdumper.py
index cacf6f9f8a..aeda15500c 100644
--- a/bbot/test/test_step_2/module_tests/test_module_gitdumper.py
+++ b/bbot/test/test_step_2/module_tests/test_module_gitdumper.py
@@ -3,11 +3,12 @@
 from pathlib import Path
 from .base import ModuleTestBase
 from bbot.test.bbot_fixtures import bbot_test_dir
+from bbot.test.worker import HTTPSERVER_PORT, HTTPSERVER_URL
 
 
 class TestGitDumper_Dirlisting(ModuleTestBase):
     targets = [
-        "http://127.0.0.1:8888/test",
+        f"{HTTPSERVER_URL}/test",
     ]
 
     modules_overrides = ["git", "gitdumper", "http"]
@@ -328,13 +329,15 @@ def check(self, module_test, events):
         assert any(
             e.type == "CODE_REPOSITORY"
             and "git-directory" in e.tags
-            and e.data["url"] == "http://127.0.0.1:8888/test/.git/"
+            and e.data["url"] == f"{HTTPSERVER_URL}/test/.git/"
             for e in events
         )
         filesystem_events = [
             e
             for e in events
-            if e.type == "FILESYSTEM" and "http-127-0-0-1-8888-test-git" in e.data["path"] and "git" in e.tags
+            if e.type == "FILESYSTEM"
+            and f"http-127-0-0-1-{HTTPSERVER_PORT}-test-git" in e.data["path"]
+            and "git" in e.tags
         ]
         assert 1 == len(filesystem_events), "Failed to git clone CODE_REPOSITORY"
         filesystem_event = filesystem_events[0]
diff --git a/bbot/test/test_step_2/module_tests/test_module_github_codesearch.py b/bbot/test/test_step_2/module_tests/test_module_github_codesearch.py
index e3241aabaa..64aae1c1e7 100644
--- a/bbot/test/test_step_2/module_tests/test_module_github_codesearch.py
+++ b/bbot/test/test_step_2/module_tests/test_module_github_codesearch.py
@@ -1,4 +1,5 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestGithub_Codesearch(ModuleTestBase):
@@ -15,7 +16,7 @@ class TestGithub_Codesearch(ModuleTestBase):
     github_file_endpoint = (
         "/projectdiscovery/nuclei/06f242e5fce3439b7418877676810cbf57934875/v2/cmd/cve-annotate/main.go"
     )
-    github_file_url = f"http://127.0.0.1:8888{github_file_endpoint}"
+    github_file_url = f"{HTTPSERVER_URL}{github_file_endpoint}"
     github_file_content = """-----BEGIN PRIVATE KEY-----
 MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOBY2pd9PSQvuxqu
 WXFNVgILTWuUc721Wc2sFNvp4beowhUe1lfxaq5ZfCJcz7z4QsqFhOeks69O9UIb
@@ -68,7 +69,7 @@ async def setup_before_prep(self, module_test):
         )
 
     async def setup_after_prep(self, module_test):
-        module_test.module.github_raw_url = "http://127.0.0.1:8888/"
+        module_test.module.github_raw_url = f"{HTTPSERVER_URL}/"
 
     def check(self, module_test, events):
         assert 1 == len([e for e in events if e.type == "URL_UNVERIFIED"])
diff --git a/bbot/test/test_step_2/module_tests/test_module_github_workflows.py b/bbot/test/test_step_2/module_tests/test_module_github_workflows.py
index 0662cf5728..bcc7f1301b 100644
--- a/bbot/test/test_step_2/module_tests/test_module_github_workflows.py
+++ b/bbot/test/test_step_2/module_tests/test_module_github_workflows.py
@@ -5,6 +5,7 @@
 from pathlib import Path
 
 from .base import ModuleTestBase
+from bbot.test.worker import BBOT_TEST_DIR
 
 
 class TestGithub_Workflows(ModuleTestBase):
@@ -538,7 +539,7 @@ async def setup_before_prep(self, module_test):
     async def setup_after_prep(self, module_test):
         m = module_test.scan.modules["github_workflows"]
 
-        symlink_target = Path("/tmp/.bbot_test/symlink_target")
+        symlink_target = Path(f"{BBOT_TEST_DIR}/symlink_target")
         if symlink_target.exists():
             shutil.rmtree(symlink_target)
         symlink_target.mkdir(parents=True, exist_ok=True)
@@ -554,9 +555,9 @@ async def setup_after_prep(self, module_test):
         os.symlink(str(symlink_target), str(bad_owner))
 
         # symlink at the output_dir level itself
-        output_dir_symlink_base = Path("/tmp/.bbot_test/fake_output_dir")
+        output_dir_symlink_base = Path(f"{BBOT_TEST_DIR}/fake_output_dir")
         output_dir_symlink_base.mkdir(parents=True, exist_ok=True)
-        output_dir_link = Path("/tmp/.bbot_test/output_dir_link")
+        output_dir_link = Path(f"{BBOT_TEST_DIR}/output_dir_link")
         if output_dir_link.is_symlink() or output_dir_link.exists():
             output_dir_link.unlink()
         os.symlink(str(output_dir_symlink_base), str(output_dir_link))
diff --git a/bbot/test/test_step_2/module_tests/test_module_gitlab_com.py b/bbot/test/test_step_2/module_tests/test_module_gitlab_com.py
index b5da946dbb..ae178128a9 100644
--- a/bbot/test/test_step_2/module_tests/test_module_gitlab_com.py
+++ b/bbot/test/test_step_2/module_tests/test_module_gitlab_com.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestGitlab_Com(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["gitlab_com", "http", "social", "excavate"]
 
     async def setup_before_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_gitlab_onprem.py b/bbot/test/test_step_2/module_tests/test_module_gitlab_onprem.py
index bbfb046f1c..08c693247e 100644
--- a/bbot/test/test_step_2/module_tests/test_module_gitlab_onprem.py
+++ b/bbot/test/test_step_2/module_tests/test_module_gitlab_onprem.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_HOSTPORT, HTTPSERVER_URL
 
 
 class TestGitlab_OnPrem(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["gitlab_onprem", "http"]
     config_overrides = {"modules": {"gitlab_onprem": {"api_key": "asdf"}}}
 
@@ -23,10 +24,10 @@ async def setup_before_prep(self, module_test):
                     "default_branch": "master",
                     "tag_list": [],
                     "topics": [],
-                    "ssh_url_to_repo": "git@127.0.0.1:8888:bbot/bbot.git",
-                    "http_url_to_repo": "http://127.0.0.1:8888/bbotgroup/bbot.git",
-                    "web_url": "http://127.0.0.1:8888/bbotgroup/bbot",
-                    "readme_url": "http://127.0.0.1:8888/bbotgroup/bbot/-/blob/master/README.md",
+                    "ssh_url_to_repo": f"git@{HTTPSERVER_HOSTPORT}:bbot/bbot.git",
+                    "http_url_to_repo": f"{HTTPSERVER_URL}/bbotgroup/bbot.git",
+                    "web_url": f"{HTTPSERVER_URL}/bbotgroup/bbot",
+                    "readme_url": f"{HTTPSERVER_URL}/bbotgroup/bbot/-/blob/master/README.md",
                     "forks_count": 0,
                     "avatar_url": None,
                     "star_count": 1,
@@ -39,7 +40,7 @@ async def setup_before_prep(self, module_test):
                         "full_path": "bbotgroup",
                         "parent_id": None,
                         "avatar_url": "/uploads/-/system/group/avatar/9/index.png",
-                        "web_url": "http://127.0.0.1:8888/groups/bbotgroup",
+                        "web_url": f"{HTTPSERVER_URL}/groups/bbotgroup",
                     },
                 },
             ],
@@ -50,7 +51,7 @@ async def setup_before_prep(self, module_test):
             [
                 {
                     "id": 9,
-                    "web_url": "http://127.0.0.1:8888/groups/bbotgroup",
+                    "web_url": f"{HTTPSERVER_URL}/groups/bbotgroup",
                     "name": "bbotgroup",
                     "path": "bbotgroup",
                     "description": "OSINT automation for hackers.",
@@ -73,7 +74,7 @@ async def setup_before_prep(self, module_test):
                         "allow_force_push": True,
                         "allowed_to_merge": [{"access_level": 30}],
                     },
-                    "avatar_url": "http://127.0.0.1:8888/uploads/-/system/group/avatar/9/index.png",
+                    "avatar_url": f"{HTTPSERVER_URL}/uploads/-/system/group/avatar/9/index.png",
                     "request_access_enabled": False,
                     "full_name": "bbotgroup",
                     "full_path": "bbotgroup",
@@ -104,9 +105,9 @@ async def setup_before_prep(self, module_test):
                     "tag_list": [],
                     "topics": [],
                     "ssh_url_to_repo": "git@blacklanternsecurity.com:bbotgroup/bbot2.git",
-                    "http_url_to_repo": "http://127.0.0.1:8888/bbotgroup/bbot2.git",
-                    "web_url": "http://127.0.0.1:8888/bbotgroup/bbot2",
-                    "readme_url": "http://127.0.0.1:8888/bbotgroup/bbot2/-/blob/master/README.md",
+                    "http_url_to_repo": f"{HTTPSERVER_URL}/bbotgroup/bbot2.git",
+                    "web_url": f"{HTTPSERVER_URL}/bbotgroup/bbot2",
+                    "readme_url": f"{HTTPSERVER_URL}/bbotgroup/bbot2/-/blob/master/README.md",
                     "forks_count": 0,
                     "avatar_url": None,
                     "star_count": 1,
@@ -119,7 +120,7 @@ async def setup_before_prep(self, module_test):
                         "full_path": "bbotgroup",
                         "parent_id": None,
                         "avatar_url": "/uploads/-/system/group/avatar/9/index.png",
-                        "web_url": "http://127.0.0.1:8888/groups/bbotgroup",
+                        "web_url": f"{HTTPSERVER_URL}/groups/bbotgroup",
                     },
                 },
             ]
@@ -140,9 +141,9 @@ async def setup_before_prep(self, module_test):
                     "tag_list": [],
                     "topics": [],
                     "ssh_url_to_repo": "git@blacklanternsecurity.com:bbotgroup/bbot3.git",
-                    "http_url_to_repo": "http://127.0.0.1:8888/bbotgroup/bbot3.git",
-                    "web_url": "http://127.0.0.1:8888/bbotgroup/bbot3",
-                    "readme_url": "http://127.0.0.1:8888/bbotgroup/bbot3/-/blob/master/README.md",
+                    "http_url_to_repo": f"{HTTPSERVER_URL}/bbotgroup/bbot3.git",
+                    "web_url": f"{HTTPSERVER_URL}/bbotgroup/bbot3",
+                    "readme_url": f"{HTTPSERVER_URL}/bbotgroup/bbot3/-/blob/master/README.md",
                     "forks_count": 0,
                     "avatar_url": None,
                     "star_count": 1,
@@ -155,7 +156,7 @@ async def setup_before_prep(self, module_test):
                         "full_path": "bbotgroup",
                         "parent_id": None,
                         "avatar_url": "/uploads/-/system/group/avatar/9/index.png",
-                        "web_url": "http://127.0.0.1:8888/groups/bbotgroup",
+                        "web_url": f"{HTTPSERVER_URL}/groups/bbotgroup",
                     },
                 },
             ]
@@ -168,7 +169,7 @@ def check(self, module_test, events):
                 for e in events
                 if e.type == "TECHNOLOGY"
                 and e.data["technology"] == "gitlab"
-                and e.data["url"] == "http://127.0.0.1:8888/"
+                and e.data["url"] == f"{HTTPSERVER_URL}/"
             ]
         )
         assert 1 == len(
@@ -178,7 +179,7 @@ def check(self, module_test, events):
                 if e.type == "SOCIAL"
                 and e.data["platform"] == "gitlab"
                 and e.data["profile_name"] == "bbotgroup"
-                and e.data["url"] == "http://127.0.0.1:8888/bbotgroup"
+                and e.data["url"] == f"{HTTPSERVER_URL}/bbotgroup"
                 and str(e.module) == "gitlab_onprem"
             ]
         )
@@ -188,7 +189,7 @@ def check(self, module_test, events):
                 for e in events
                 if e.type == "CODE_REPOSITORY"
                 and "git" in e.tags
-                and e.data["url"] == "http://127.0.0.1:8888/bbotgroup/bbot"
+                and e.data["url"] == f"{HTTPSERVER_URL}/bbotgroup/bbot"
             ]
         )
         assert 1 == len(
@@ -197,7 +198,7 @@ def check(self, module_test, events):
                 for e in events
                 if e.type == "CODE_REPOSITORY"
                 and "git" in e.tags
-                and e.data["url"] == "http://127.0.0.1:8888/bbotgroup/bbot2"
+                and e.data["url"] == f"{HTTPSERVER_URL}/bbotgroup/bbot2"
             ]
         )
         assert 1 == len(
@@ -206,6 +207,6 @@ def check(self, module_test, events):
                 for e in events
                 if e.type == "CODE_REPOSITORY"
                 and "git" in e.tags
-                and e.data["url"] == "http://127.0.0.1:8888/bbotgroup/bbot3"
+                and e.data["url"] == f"{HTTPSERVER_URL}/bbotgroup/bbot3"
             ]
         )
diff --git a/bbot/test/test_step_2/module_tests/test_module_gowitness.py b/bbot/test/test_step_2/module_tests/test_module_gowitness.py
index f67836b72c..8df6f9ae39 100644
--- a/bbot/test/test_step_2/module_tests/test_module_gowitness.py
+++ b/bbot/test/test_step_2/module_tests/test_module_gowitness.py
@@ -1,15 +1,23 @@
 from pathlib import Path
 
 from .base import ModuleTestBase
+from bbot.test.worker import (
+    worker_dir,
+    HTTPSERVER_HOSTPORT,
+    HTTPSERVER_PORT,
+    HTTPSERVER_SSL_PORT,
+    HTTPSERVER_SSL_URL,
+    HTTPSERVER_URL,
+)
 
 
 class TestGowitness(ModuleTestBase):
-    targets = ["127.0.0.1:8888"]
+    targets = [HTTPSERVER_HOSTPORT]
     modules_overrides = ["gowitness", "http", "social", "excavate"]
     import shutil
     from pathlib import Path
 
-    home_dir = Path("/tmp/.bbot_gowitness_test")
+    home_dir = worker_dir("/tmp/.bbot_gowitness_test")
     shutil.rmtree(home_dir, ignore_errors=True)
     config_overrides = {
         "deps": {"behavior": "force_install"},
@@ -38,7 +46,7 @@ async def setup_after_prep(self, module_test):
 
         async def new_emit_event(event, **kwargs):
             if event.data["url"] == "https://github.com/blacklanternsecurity":
-                event.data["url"] = event.data["url"].replace("https://github.com", "http://127.0.0.1:8888")
+                event.data["url"] = event.data["url"].replace("https://github.com", HTTPSERVER_URL)
                 event.parsed_url = module_test.scan.helpers.urlparse(event.data["url"])
             await old_emit_event(event, **kwargs)
 
@@ -56,14 +64,14 @@ def check(self, module_test, events):
         assert len(screenshots) == 1, (
             f"{len(screenshots):,} .jpeg files found at {screenshots_path}, should have been 1"
         )
-        assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/"])
+        assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/"])
         assert 1 == len([e for e in events if e.type == "URL_UNVERIFIED" and e.url == "https://fonts.googleapis.com/"])
         assert 0 == len([e for e in events if e.type == "URL" and e.url == "https://fonts.googleapis.com/"])
         assert 1 == len(
-            [e for e in events if e.type == "SOCIAL" and e.data["url"] == "http://127.0.0.1:8888/blacklanternsecurity"]
+            [e for e in events if e.type == "SOCIAL" and e.data["url"] == f"{HTTPSERVER_URL}/blacklanternsecurity"]
         )
         assert 1 == len([e for e in events if e.type == "WEBSCREENSHOT"])
-        assert 1 == len([e for e in events if e.type == "WEBSCREENSHOT" and e.data["url"] == "http://127.0.0.1:8888/"])
+        assert 1 == len([e for e in events if e.type == "WEBSCREENSHOT" and e.data["url"] == f"{HTTPSERVER_URL}/"])
         assert len([e for e in events if e.type == "TECHNOLOGY"])
 
 
@@ -82,7 +90,7 @@ def check(self, module_test, events):
             [
                 e
                 for e in events
-                if e.type == "WEBSCREENSHOT" and e.data["url"] == "http://127.0.0.1:8888/blacklanternsecurity"
+                if e.type == "WEBSCREENSHOT" and e.data["url"] == f"{HTTPSERVER_URL}/blacklanternsecurity"
             ]
         )
         assert len(
@@ -90,7 +98,7 @@ def check(self, module_test, events):
                 e
                 for e in events
                 if e.type == "TECHNOLOGY"
-                and e.data["url"] == "http://127.0.0.1:8888/blacklanternsecurity"
+                and e.data["url"] == f"{HTTPSERVER_URL}/blacklanternsecurity"
                 and e.parent.type == "SOCIAL"
             ]
         )
@@ -111,7 +119,7 @@ class TestGoWitnessLongFilename(TestGowitness):
     """
 
     targets = [
-        "http://127.0.0.1:8888/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity"
+        f"{HTTPSERVER_URL}/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity/blacklanternsecurity"
     ]
     config_overrides = {"file_blobs": True}
 
@@ -138,16 +146,16 @@ def check(self, module_test, events):
 class TestGowitness_MultiPort(ModuleTestBase):
     """
     Integration test: two URLs on the same host with different ports
-    (HTTP :8888 and HTTPS :9999) both get correctly correlated screenshots.
+    (one HTTP, one HTTPS) both get correctly correlated screenshots.
     Exercises the real gowitness binary and _resolve_parent tiered lookup.
     """
 
-    targets = ["http://127.0.0.1:8888", "https://127.0.0.1:9999"]
+    targets = [HTTPSERVER_URL, HTTPSERVER_SSL_URL]
     modules_overrides = ["gowitness", "http"]
 
     import shutil
 
-    home_dir = Path("/tmp/.bbot_gowitness_multiport_test")
+    home_dir = worker_dir("/tmp/.bbot_gowitness_multiport_test")
     shutil.rmtree(home_dir, ignore_errors=True)
     config_overrides = {
         "deps": {"behavior": "force_install"},
@@ -156,16 +164,16 @@ class TestGowitness_MultiPort(ModuleTestBase):
     }
 
     async def setup_after_prep(self, module_test):
-        # HTTP server on port 8888
+        # plain HTTP server
         module_test.set_expect_requests(
             respond_args={
-                "response_data": "<html><head><title>Port 8888</title></head><body>Port 8888</body></html>",
+                "response_data": f"<html><head><title>Port {HTTPSERVER_PORT}</title></head><body>Port {HTTPSERVER_PORT}</body></html>",
                 "headers": {"Server": "Apache/2.4.41"},
             },
         )
-        # HTTPS server on port 9999
+        # TLS server
         module_test.httpserver_ssl.expect_request("/").respond_with_data(
-            "<html><head><title>Port 9999</title></head><body>Port 9999</body></html>",
+            f"<html><head><title>Port {HTTPSERVER_SSL_PORT}</title></head><body>Port {HTTPSERVER_SSL_PORT}</body></html>",
             headers={"Server": "nginx/1.18.0"},
         )
 
@@ -174,14 +182,19 @@ def check(self, module_test, events):
         assert len(webscreenshots) >= 2, f"Expected at least 2 WEBSCREENSHOT events, got {len(webscreenshots)}"
 
         screenshot_urls = {e.data["url"] for e in webscreenshots}
-        assert any("8888" in url for url in screenshot_urls), f"No screenshot for port 8888. URLs: {screenshot_urls}"
-        assert any("9999" in url for url in screenshot_urls), f"No screenshot for port 9999. URLs: {screenshot_urls}"
+        http_port, ssl_port = str(HTTPSERVER_PORT), str(HTTPSERVER_SSL_PORT)
+        assert any(http_port in url for url in screenshot_urls), (
+            f"No screenshot for port {http_port}. URLs: {screenshot_urls}"
+        )
+        assert any(ssl_port in url for url in screenshot_urls), (
+            f"No screenshot for port {ssl_port}. URLs: {screenshot_urls}"
+        )
 
         # Verify parent events reference the correct port
         for ws in webscreenshots:
             url = ws.data["url"]
             parent = ws.parent
-            if "8888" in url:
-                assert "8888" in str(parent.data), f"Screenshot for :8888 has wrong parent: {parent.data}"
-            elif "9999" in url:
-                assert "9999" in str(parent.data), f"Screenshot for :9999 has wrong parent: {parent.data}"
+            if http_port in url:
+                assert http_port in str(parent.data), f"Screenshot for :{http_port} has wrong parent: {parent.data}"
+            elif ssl_port in url:
+                assert ssl_port in str(parent.data), f"Screenshot for :{ssl_port} has wrong parent: {parent.data}"
diff --git a/bbot/test/test_step_2/module_tests/test_module_graphql_introspection.py b/bbot/test/test_step_2/module_tests/test_module_graphql_introspection.py
index dd0380f653..b9c1023f1c 100644
--- a/bbot/test/test_step_2/module_tests/test_module_graphql_introspection.py
+++ b/bbot/test/test_step_2/module_tests/test_module_graphql_introspection.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestGraphQLIntrospectionNon200(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["graphql_introspection"]
 
     async def setup_after_prep(self, module_test):
@@ -16,7 +17,7 @@ def check(self, module_test, events):
 
 
 class TestGraphQLIntrospection(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["graphql_introspection"]
 
     async def setup_after_prep(self, module_test):
@@ -30,5 +31,5 @@ async def setup_after_prep(self, module_test):
     def check(self, module_test, events):
         finding = [e for e in events if e.type == "FINDING"]
         assert finding, "should have raised 1 FINDING event"
-        assert finding[0].data["url"] == "http://127.0.0.1:8888/"
-        assert finding[0].data["description"] == "GraphQL Schema at http://127.0.0.1:8888/"
+        assert finding[0].data["url"] == f"{HTTPSERVER_URL}/"
+        assert finding[0].data["description"] == f"GraphQL Schema at {HTTPSERVER_URL}/"
diff --git a/bbot/test/test_step_2/module_tests/test_module_host_header.py b/bbot/test/test_step_2/module_tests/test_module_host_header.py
index cf41260b5d..ed609970fc 100644
--- a/bbot/test/test_step_2/module_tests/test_module_host_header.py
+++ b/bbot/test/test_step_2/module_tests/test_module_host_header.py
@@ -2,6 +2,7 @@
 from werkzeug.wrappers import Response
 
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 def extract_subdomain_tag(data):
@@ -12,7 +13,7 @@ def extract_subdomain_tag(data):
 
 
 class TestHost_Header(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "host_header"]
 
     fake_host = "fakedomain.fakeinteractsh.com"
diff --git a/bbot/test/test_step_2/module_tests/test_module_http.py b/bbot/test/test_step_2/module_tests/test_module_http.py
index 92eb728258..029c655f8b 100644
--- a/bbot/test/test_step_2/module_tests/test_module_http.py
+++ b/bbot/test/test_step_2/module_tests/test_module_http.py
@@ -1,10 +1,17 @@
 from werkzeug.wrappers import Response
 
 from .base import ModuleTestBase
+from bbot.test.worker import (
+    HTTPSERVER_HOSTPORT,
+    HTTPSERVER_PORT,
+    HTTPSERVER_SSL_PORT,
+    HTTPSERVER_SSL_URL,
+    HTTPSERVER_URL,
+)
 
 
 class TestHTTPBase(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/url", "127.0.0.1:8888"]
+    targets = [f"{HTTPSERVER_URL}/url", HTTPSERVER_HOSTPORT]
     module_name = "http"
     modules_overrides = ["http", "excavate"]
     config_overrides = {"modules": {"http": {"store_responses": True}}}
@@ -53,30 +60,31 @@ def check(self, module_test, events):
                     url = True
         assert url, "Failed to visit target URL"
         assert open_port, "Failed to visit target OPEN_TCP_PORT"
-        saved_response = module_test.scan.home / "http_responses" / "127.0.0.1.8888[slash]url.txt"
+        # The http module encodes host:port into the filename with a dot separator.
+        saved_response = module_test.scan.home / "http_responses" / f"127.0.0.1.{HTTPSERVER_PORT}[slash]url.txt"
         assert saved_response.is_file(), "Failed to save raw http response"
 
 
 class TestHTTP_404(ModuleTestBase):
-    targets = ["https://127.0.0.1:9999"]
+    targets = [HTTPSERVER_SSL_URL]
     modules_overrides = ["http", "speculate", "excavate"]
-    config_overrides = {"modules": {"speculate": {"ports": "8888,9999"}}}
+    config_overrides = {"modules": {"speculate": {"ports": f"{HTTPSERVER_PORT},{HTTPSERVER_SSL_PORT}"}}}
 
     async def setup_after_prep(self, module_test):
         module_test.httpserver.expect_request("/").respond_with_data(
-            "Redirecting...", status=301, headers={"Location": "https://127.0.0.1:9999"}
+            "Redirecting...", status=301, headers={"Location": HTTPSERVER_SSL_URL}
         )
         module_test.httpserver_ssl.expect_request("/").respond_with_data("404 not found", status=404)
 
     def check(self, module_test, events):
         assert 1 == len(
-            [e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and "status-301" in e.tags]
+            [e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and "status-301" in e.tags]
         )
-        assert 1 == len([e for e in events if e.type == "URL" and e.url == "https://127.0.0.1:9999/"])
+        assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_SSL_URL}/"])
 
 
 class TestHTTP_Redirect(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "speculate", "excavate"]
 
     async def setup_after_prep(self, module_test):
@@ -86,7 +94,7 @@ async def setup_after_prep(self, module_test):
 
     def check(self, module_test, events):
         assert 1 == len(
-            [e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/" and "status-301" in e.tags]
+            [e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/" and "status-301" in e.tags]
         )
         assert 1 == len(
             [
@@ -105,7 +113,7 @@ def check(self, module_test, events):
 
 
 class TestHTTP_URLBlacklist(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "speculate", "excavate"]
     config_overrides = {"web": {"spider_distance": 10, "spider_depth": 10}}
 
@@ -123,33 +131,33 @@ def check(self, module_test, events):
         assert 4 == len([e for e in events if e.type == "URL_UNVERIFIED"])
         assert 3 == len([e for e in events if e.type == "HTTP_RESPONSE"])
         assert 3 == len([e for e in events if e.type == "URL"])
-        assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/"])
-        assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/test.aspx"])
-        assert 1 == len([e for e in events if e.type == "URL" and e.url == "http://127.0.0.1:8888/test.txt"])
+        assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/"])
+        assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/test.aspx"])
+        assert 1 == len([e for e in events if e.type == "URL" and e.url == f"{HTTPSERVER_URL}/test.txt"])
         assert not any(e for e in events if "URL" in e.type and ".svg" in e.url)
         assert not any(e for e in events if "URL" in e.type and ".woff" in e.url)
 
 
 class TestHTTP_querystring_removed(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "speculate", "excavate"]
 
     async def setup_after_prep(self, module_test):
         module_test.httpserver.expect_request("/").respond_with_data('<a href="/test.php?foo=bar"/>')
 
     def check(self, module_test, events):
-        assert [e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/test.php"]
+        assert [e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/test.php"]
 
 
 class TestHTTP_querystring_notremoved(TestHTTP_querystring_removed):
     config_overrides = {"url_querystring_remove": False}
 
     def check(self, module_test, events):
-        assert [e for e in events if e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/test.php?foo=bar"]
+        assert [e for e in events if e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/test.php?foo=bar"]
 
 
 class TestHTTP_custom_headers(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "speculate", "excavate"]
     config_overrides = {"web": {"http_headers": {"testheader": "testvalue"}}}
 
@@ -162,7 +170,7 @@ def check(self, module_test, events):
 
 
 class TestHTTP_custom_cookies(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "speculate", "excavate"]
     config_overrides = {"web": {"http_cookies": {"testcookie": "cookievalue"}}}
 
@@ -186,7 +194,7 @@ class TestHTTP_429_retry(ModuleTestBase):
     request (from the module's retry after cooldown) succeeds.
     """
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http"]
     config_overrides = {"web": {"429_sleep_interval": 1, "429_max_sleep_interval": 1}}
 
@@ -219,7 +227,7 @@ class TestHTTP_url_metadata(ModuleTestBase):
     dedup is unaffected, and IPv6 hosts get bracketed netlocs.
     """
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "http"
     modules_overrides = ["http"]
 
@@ -251,7 +259,7 @@ def check(self, module_test, events):
 
 
 class TestHTTP_429_max_retries(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http"]
     config_overrides = {"web": {"429_sleep_interval": 1, "429_max_sleep_interval": 1}}
 
diff --git a/bbot/test/test_step_2/module_tests/test_module_hunt.py b/bbot/test/test_step_2/module_tests/test_module_hunt.py
index 9a8bb56f13..42e42418c2 100644
--- a/bbot/test/test_step_2/module_tests/test_module_hunt.py
+++ b/bbot/test/test_step_2/module_tests/test_module_hunt.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestHunt(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "hunt", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
diff --git a/bbot/test/test_step_2/module_tests/test_module_iis_shortnames.py b/bbot/test/test_step_2/module_tests/test_module_iis_shortnames.py
index 0821eba42e..f206f8b4e1 100644
--- a/bbot/test/test_step_2/module_tests/test_module_iis_shortnames.py
+++ b/bbot/test/test_step_2/module_tests/test_module_iis_shortnames.py
@@ -1,10 +1,11 @@
 import re
 
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestIIS_Shortnames(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "iis_shortnames"]
     config_overrides = {"modules": {"iis_shortnames": {"detect_only": False}}}
 
@@ -96,7 +97,7 @@ def check(self, module_test, events):
         for e in events:
             if e.type == "FINDING" and "iis-magic-url" not in e.tags:
                 magicurl_findingEmitted = True
-            if e.type == "URL_HINT" and e.url == "http://127.0.0.1:8888/BLSHAX~1":
+            if e.type == "URL_HINT" and e.url == f"{HTTPSERVER_URL}/BLSHAX~1":
                 url_hintEmitted = True
             if e.type == "FINDING" and "Possible backup file (zip) in web root" in e.data["description"]:
                 zip_findingEmitted = True
@@ -109,7 +110,7 @@ def check(self, module_test, events):
 class TestIIS_Shortnames_GatewayError(ModuleTestBase):
     """Negative test: server returns 502 gateway errors. Should NOT detect IIS shortnames."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "iis_shortnames"]
 
     async def setup_after_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_json.py b/bbot/test/test_step_2/module_tests/test_module_json.py
index 163fe62421..949478fa8f 100644
--- a/bbot/test/test_step_2/module_tests/test_module_json.py
+++ b/bbot/test/test_step_2/module_tests/test_module_json.py
@@ -2,6 +2,7 @@
 
 from .base import ModuleTestBase
 from bbot.core.event.base import event_from_json
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestJSON(ModuleTestBase):
@@ -65,7 +66,7 @@ class TestJSONGraphOrphanJSURL(ModuleTestBase):
     reference a parent that is also in the output (no orphans).
     """
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "json"]
     # The test conf clears omit_event_types — restore the production default so
     # URL_UNVERIFIED (which JS URLs use) actually gets _omit=True by ScanEgress.
@@ -87,7 +88,7 @@ async def setup_after_prep(self, module_test):
         module_test.set_expect_requests(
             expect_args={"method": "GET", "uri": "/"},
             respond_args={
-                "response_data": "<html><body><script src='http://127.0.0.1:8888/asdf.js'></script></body></html>",
+                "response_data": f"<html><body><script src='{HTTPSERVER_URL}/asdf.js'></script></body></html>",
                 "headers": {"Content-Type": "text/html"},
             },
         )
diff --git a/bbot/test/test_step_2/module_tests/test_module_kreuzberg.py b/bbot/test/test_step_2/module_tests/test_module_kreuzberg.py
index 2abd6c9d30..231201dd90 100644
--- a/bbot/test/test_step_2/module_tests/test_module_kreuzberg.py
+++ b/bbot/test/test_step_2/module_tests/test_module_kreuzberg.py
@@ -3,10 +3,11 @@
 from .base import ModuleTestBase
 
 from ...bbot_fixtures import *
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestKreuzberg(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["kreuzberg", "filedownload", "http", "excavate", "speculate"]
     config_overrides = {
         "web": {
diff --git a/bbot/test/test_step_2/module_tests/test_module_lightfuzz.py b/bbot/test/test_step_2/module_tests/test_module_lightfuzz.py
index e9cc38b87d..7dd58874f3 100644
--- a/bbot/test/test_step_2/module_tests/test_module_lightfuzz.py
+++ b/bbot/test/test_step_2/module_tests/test_module_lightfuzz.py
@@ -14,6 +14,7 @@
 from bbot.modules.lightfuzz.submodules.base import BaseLightfuzz
 
 from .test_module_paramminer_headers import helper
+from bbot.test.worker import HTTPSERVER_URL
 
 
 def _make_base_lightfuzz(url):
@@ -57,7 +58,7 @@ def test_lightfuzz_build_query_string_preserves_fragment():
 
 # Path Traversal single dot tolerance
 class Test_Lightfuzz_path_singledot(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -281,7 +282,7 @@ def check(self, module_test, events):
 
 # SSTI Integer Multiplcation
 class Test_Lightfuzz_ssti_multiply(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -426,7 +427,7 @@ def check(self, module_test, events):
 
 # Between Tags XSS Detection
 class Test_Lightfuzz_xss(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -1187,7 +1188,7 @@ def check(self, module_test, events):
 
 # SQLI Single Quote/Two Single Quote (getparam)
 class Test_Lightfuzz_sqli(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -1260,7 +1261,7 @@ def check(self, module_test, events):
 
 # SQLI Single Quote/Two Single Quote (postparam)
 class Test_Lightfuzz_sqli_post(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -1371,7 +1372,7 @@ async def setup_after_prep(self, module_test):
 
         seed_events = []
         parent_event = module_test.scan.make_event(
-            "http://127.0.0.1:8888/",
+            f"{HTTPSERVER_URL}/",
             "URL",
             module_test.scan.root_event,
             module="http",
@@ -1383,7 +1384,7 @@ async def setup_after_prep(self, module_test):
             "type": "HEADER",
             "name": "testheader",
             "original_value": None,
-            "url": "http://127.0.0.1:8888",
+            "url": HTTPSERVER_URL,
             "description": "Test Dummy Header",
         }
         seed_event = module_test.scan.make_event(data, "WEB_PARAMETER", parent_event, tags=["distance-0"])
@@ -1441,7 +1442,7 @@ async def setup_after_prep(self, module_test):
 
         seed_events = []
         parent_event = module_test.scan.make_event(
-            "http://127.0.0.1:8888/",
+            f"{HTTPSERVER_URL}/",
             "URL",
             module_test.scan.root_event,
             module="http",
@@ -1453,7 +1454,7 @@ async def setup_after_prep(self, module_test):
             "type": "COOKIE",
             "name": "test",
             "original_value": None,
-            "url": "http://127.0.0.1:8888",
+            "url": HTTPSERVER_URL,
             "description": "Test Dummy Cookie",
         }
         seed_event = module_test.scan.make_event(data, "WEB_PARAMETER", parent_event, tags=["distance-0"])
@@ -1676,7 +1677,7 @@ def check(self, module_test, events):
 
 # Serialization Module (Error Resolution)
 class Test_Lightfuzz_serial_errorresolution(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -1759,7 +1760,7 @@ def check(self, module_test, events):
                 if e.data["name"] == "TextBox1":
                     excavate_extracted_form_parameter = True
                     if (
-                        e.data["url"] == "http://127.0.0.1:8888/deser.aspx"
+                        e.data["url"] == f"{HTTPSERVER_URL}/deser.aspx"
                         and e.data["host"] == "127.0.0.1"
                         and e.data["additional_params"]
                         == {
@@ -1861,7 +1862,7 @@ def check(self, module_test, events):
                 if e.data["name"] == "TextBox1":
                     excavate_extracted_form_parameter = True
                     if (
-                        e.data["url"] == "http://127.0.0.1:8888/deser.aspx"
+                        e.data["url"] == f"{HTTPSERVER_URL}/deser.aspx"
                         and e.data["host"] == "127.0.0.1"
                         and e.data["original_value"] == "AAEAAAD/////AQAAAAAAAAAGAQAAAAdndXN0YXZvCw=="
                         and e.data["additional_params"]
@@ -2234,7 +2235,7 @@ def check(self, module_test, events):
 
 # CMDi echo canary
 class Test_Lightfuzz_cmdi(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -2516,7 +2517,7 @@ def check(self, module_test, events):
 
 # SSRF interactsh
 class Test_Lightfuzz_ssrf(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
 
     @staticmethod
@@ -2600,7 +2601,7 @@ def check(self, module_test, events):
 
 
 class Test_Lightfuzz_speculative(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "paramminer_getparams", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -2657,7 +2658,7 @@ def check(self, module_test, events):
 
 
 class Test_Lightfuzz_crypto_error(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -2722,7 +2723,7 @@ def check(self, module_test, events):
 
 
 class Test_Lightfuzz_crypto_error_falsepositive(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -2768,7 +2769,7 @@ def check(self, module_test, events):
 
 
 class Test_Lightfuzz_PaddingOracleDetection(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -2980,7 +2981,7 @@ class Test_Lightfuzz_PaddingOracleDetection_NarrowCharset(ModuleTestBase):
     round-trip as valid base64 but are not actual cryptographic data.
     The narrow charset check should reject these, preventing false findings."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3001,7 +3002,7 @@ async def setup_after_prep(self, module_test):
         module_test.set_expect_requests_handler(expect_args=re.compile(".*"), request_handler=self.request_handler)
 
         parent_event = module_test.scan.make_event(
-            "http://127.0.0.1:8888/",
+            f"{HTTPSERVER_URL}/",
             "URL",
             module_test.scan.root_event,
             module="http",
@@ -3013,7 +3014,7 @@ async def setup_after_prep(self, module_test):
             "type": "COOKIE",
             "name": "custom_session_cookie",
             "original_value": self.narrow_charset_value,
-            "url": "http://127.0.0.1:8888/",
+            "url": f"{HTTPSERVER_URL}/",
             "description": "Test narrow charset cookie",
         }
         seed_event = module_test.scan.make_event(data, "WEB_PARAMETER", parent_event, tags=["distance-0"])
@@ -3107,7 +3108,7 @@ def check(self, module_test, events):
 
 
 class Test_Lightfuzz_XSS_jsquotecontext(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate", "paramminer_getparams"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3235,7 +3236,7 @@ def check(self, module_test, events):
 
 
 class Test_Lightfuzz_esi(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3408,7 +3409,7 @@ class Test_Lightfuzz_envelope_isolation_paddingoracle_reflecting(Test_Lightfuzz_
 
 # ECB Mode Detection: ciphertext with repeated 16-byte blocks (A+B+A+B pattern)
 class Test_Lightfuzz_ECBDetection(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3454,7 +3455,7 @@ def check(self, module_test, events):
 
 # ECB Negative: all unique blocks, should NOT detect ECB
 class Test_Lightfuzz_ECBDetection_Negative(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3502,7 +3503,7 @@ def check(self, module_test, events):
 
 # CBC Bit-Flipping Detection: server returns different responses for different byte-position mutations
 class Test_Lightfuzz_CBCBitflipDetection(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3561,7 +3562,7 @@ def check(self, module_test, events):
 
 # CBC Bit-Flipping Negative: server returns identical response regardless of mutation position
 class Test_Lightfuzz_CBCBitflipDetection_Negative(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3602,7 +3603,7 @@ def check(self, module_test, events):
 # Padding oracle sends ~254 probes that all get unique responses → differ_count >> block_size → not detected.
 # CBC bit-flip probes still produce different responses → detected.
 class Test_Lightfuzz_CBCBitflipDetection_NoPaddingOracle(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3690,7 +3691,7 @@ class Test_Lightfuzz_envelope_isolation_cbc_bitflip_no_po(Test_Lightfuzz_CBCBitf
 
 # Test filter_event method with WAF tags
 class Test_Lightfuzz_filter_event(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3705,7 +3706,7 @@ class Test_Lightfuzz_filter_event(ModuleTestBase):
     async def setup_after_prep(self, module_test):
         # Create test events with WAF tags
         self.url_event_with_waf = module_test.scan.make_event(
-            "http://127.0.0.1:8888/",
+            f"{HTTPSERVER_URL}/",
             "URL",
             module_test.scan.root_event,
             module="http",
@@ -3718,7 +3719,7 @@ async def setup_after_prep(self, module_test):
                 "type": "GETPARAM",
                 "name": "test",
                 "original_value": "value",
-                "url": "http://127.0.0.1:8888/",
+                "url": f"{HTTPSERVER_URL}/",
                 "description": "Test parameter",
             },
             "WEB_PARAMETER",
@@ -3728,7 +3729,7 @@ async def setup_after_prep(self, module_test):
         )
 
         self.url_event_without_waf = module_test.scan.make_event(
-            "http://127.0.0.1:8888/",
+            f"{HTTPSERVER_URL}/",
             "URL",
             module_test.scan.root_event,
             module="http",
@@ -3741,7 +3742,7 @@ async def setup_after_prep(self, module_test):
                 "type": "GETPARAM",
                 "name": "test",
                 "original_value": "value",
-                "url": "http://127.0.0.1:8888/",
+                "url": f"{HTTPSERVER_URL}/",
                 "description": "Test parameter",
             },
             "WEB_PARAMETER",
@@ -3776,7 +3777,7 @@ def check(self, module_test, events):
 
 # try_post_as_get: fuzz POST parameters as GET parameters
 class Test_Lightfuzz_try_post_as_get(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -3859,7 +3860,7 @@ def check(self, module_test, events):
 
 # try_get_as_post: fuzz GET parameters as POST parameters
 class Test_Lightfuzz_try_get_as_post(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4149,7 +4150,7 @@ def check(self, module_test, events):
 
 # Verify that POST SQLi findings include additional_params in the description
 class Test_Lightfuzz_sqli_post_additional_params(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4200,7 +4201,7 @@ def check(self, module_test, events):
 
 # Verify that lightfuzz rejects WEB_PARAMETER events on static-asset URLs (.pdf, .xml, etc.)
 class Test_Lightfuzz_static_url_filter(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4222,7 +4223,7 @@ async def setup_after_prep(self, module_test):
         # Inject a WEB_PARAMETER event on a .pdf URL
         seed_events = []
         parent_event = module_test.scan.make_event(
-            "http://127.0.0.1:8888/",
+            f"{HTTPSERVER_URL}/",
             "URL",
             module_test.scan.root_event,
             module="http",
@@ -4233,7 +4234,7 @@ async def setup_after_prep(self, module_test):
             "type": "GETPARAM",
             "name": "v",
             "original_value": "1",
-            "url": "http://127.0.0.1:8888/document.pdf?v=1",
+            "url": f"{HTTPSERVER_URL}/document.pdf?v=1",
             "description": "HTTP Extracted Parameter [v]",
         }
         seed_event = module_test.scan.make_event(data, "WEB_PARAMETER", parent_event, tags=["distance-0"])
@@ -4267,7 +4268,7 @@ def check(self, module_test, events):
 # empty option, lightfuzz doesn't fire the baseline POST, the baseline response
 # isn't emitted, or excavate doesn't see it — the URL_UNVERIFIED never appears.
 class Test_Lightfuzz_baseline_to_excavate_chain(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4326,7 +4327,7 @@ def check(self, module_test, events):
         # server wouldn't have revealed it), lightfuzz fired a properly-formed
         # POST baseline, the response was emitted as HTTP_RESPONSE, and excavate
         # mined the new URL out of the body.
-        secret_url = "http://127.0.0.1:8888/secret-endpoint"
+        secret_url = f"{HTTPSERVER_URL}/secret-endpoint"
         secret_seen = any(
             e.type == "URL_UNVERIFIED" and str(getattr(e, "data", {}).get("url", "") or e.data) == secret_url
             for e in events
@@ -4384,7 +4385,7 @@ def check(self, module_test, events):
 # via the new same_param_values field; lightfuzz crypto's keystream-reuse check
 # then pairwise-XORs them and emits a HIGH/CONFIRMED FINDING.
 class Test_Lightfuzz_keystream_reuse(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4479,7 +4480,7 @@ def check(self, module_test, events):
 # own connectivity GET issues token-2, which the merge logic substitutes in,
 # letting the baseline POST succeed.
 class Test_Lightfuzz_cookie_refresh(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4552,7 +4553,7 @@ def check(self, module_test, events):
         # POST carries the current (post-refresh) token. If the stale spider-era
         # cookie had been used, the server would have returned "Session expired"
         # and excavate would have nothing to extract.
-        secret_url = "http://127.0.0.1:8888/secret-endpoint"
+        secret_url = f"{HTTPSERVER_URL}/secret-endpoint"
         secret_seen = any(
             e.type == "URL_UNVERIFIED" and str(getattr(e, "data", {}).get("url", "") or e.data) == secret_url
             for e in events
@@ -4575,7 +4576,7 @@ def check(self, module_test, events):
 # URL_UNVERIFIED. If baseline_probe fires a body-less request, the URL is
 # never revealed and the assertion fails.
 class Test_Lightfuzz_baseline_probe_form_submission(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4623,7 +4624,7 @@ def handler(request):
         )
 
     def check(self, module_test, events):
-        secret_url = "http://127.0.0.1:8888/crypto-baseline-secret"
+        secret_url = f"{HTTPSERVER_URL}/crypto-baseline-secret"
         secret_seen = any(
             e.type == "URL_UNVERIFIED" and str(getattr(e, "data", {}).get("url", "") or e.data) == secret_url
             for e in events
@@ -4648,7 +4649,7 @@ def check(self, module_test, events):
 # up a server that only reveals /none-bug-secret when the no-value-attr field
 # arrives as "" (browser-equivalent), and rejects literal "None".
 class Test_Lightfuzz_none_in_additional_params(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4694,7 +4695,7 @@ def handler(request):
         )
 
     def check(self, module_test, events):
-        secret_url = "http://127.0.0.1:8888/none-bug-secret"
+        secret_url = f"{HTTPSERVER_URL}/none-bug-secret"
         secret_seen = any(
             e.type == "URL_UNVERIFIED" and str(getattr(e, "data", {}).get("url", "") or e.data) == secret_url
             for e in events
@@ -4710,7 +4711,7 @@ def check(self, module_test, events):
 # useful content only renders for a non-empty query are invisible to Probe A
 # (which submits the field as empty) but mineable from Probe B's response.
 class Test_Lightfuzz_baseline_probe_dual_search_form(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4742,7 +4743,7 @@ def handler(request):
         )
 
     def check(self, module_test, events):
-        secret_url = "http://127.0.0.1:8888/dual-probe-secret"
+        secret_url = f"{HTTPSERVER_URL}/dual-probe-secret"
         secret_seen = any(
             e.type == "URL_UNVERIFIED" and str(getattr(e, "data", {}).get("url", "") or e.data) == secret_url
             for e in events
@@ -4758,7 +4759,7 @@ def check(self, module_test, events):
 # a meaningful default with an arbitrary value. Verify that the form-action
 # endpoint receives exactly one POST per scan (Probe A only).
 class Test_Lightfuzz_baseline_probe_no_dual_for_selected(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4816,7 +4817,7 @@ def check(self, module_test, events):
 # cookies. This server only reveals /host-cookie-secret when the POST carries
 # a cookie that's only set on the host page's GET response.
 class Test_Lightfuzz_host_url_priming(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/host.html"]
+    targets = [f"{HTTPSERVER_URL}/host.html"]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -4870,7 +4871,7 @@ def handler(request):
         )
 
     def check(self, module_test, events):
-        secret_url = "http://127.0.0.1:8888/host-cookie-secret"
+        secret_url = f"{HTTPSERVER_URL}/host-cookie-secret"
         secret_seen = any(
             e.type == "URL_UNVERIFIED" and str(getattr(e, "data", {}).get("url", "") or e.data) == secret_url
             for e in events
@@ -5139,7 +5140,7 @@ def check(self, module_test, events):
 
 
 class Test_Lightfuzz_type_mutation_restored(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -5301,7 +5302,7 @@ def check(self, module_test, events):
 
 
 class Test_Lightfuzz_connectivity_no_cache_none(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
@@ -5359,7 +5360,7 @@ def check(self, module_test, events):
 class TestLightfuzzWildcardSkip(ModuleTestBase):
     """When the host is an HTTP wildcard, lightfuzz should skip fuzzing entirely."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "lightfuzz", "excavate"]
     config_overrides = {
         "interactsh_disable": True,
diff --git a/bbot/test/test_step_2/module_tests/test_module_mongo.py b/bbot/test/test_step_2/module_tests/test_module_mongo.py
index 94ea545715..f889dc1204 100644
--- a/bbot/test/test_step_2/module_tests/test_module_mongo.py
+++ b/bbot/test/test_step_2/module_tests/test_module_mongo.py
@@ -1,6 +1,7 @@
 import asyncio
 
 from .base import ModuleTestBase
+from bbot.test.worker import wait_for_container
 
 
 class TestMongo(ModuleTestBase):
@@ -41,17 +42,14 @@ async def setup_after_prep(self, module_test):
         from pymongo import AsyncMongoClient
 
         # Connect to the MongoDB collection with retry logic
-        while True:
-            try:
-                client = AsyncMongoClient("mongodb://localhost:27017", username="bbot", password="bbotislife")
-                db = client[self.test_db_name]
-                events_collection = db.get_collection(self.test_collection_prefix + "events")
-                # Attempt a simple operation to confirm the connection
-                await events_collection.count_documents({})
-                break  # Exit the loop if connection is successful
-            except Exception as e:
-                print(f"Connection failed: {e}. Retrying...")
-                await asyncio.sleep(0.5)
+        async def connect():
+            client = AsyncMongoClient("mongodb://localhost:27017", username="bbot", password="bbotislife")
+            db = client[self.test_db_name]
+            events_collection = db.get_collection(self.test_collection_prefix + "events")
+            await events_collection.count_documents({})
+            return client, events_collection
+
+        client, events_collection = await wait_for_container("MongoDB", connect)
 
         # Check that there are no events in the collection
         count = await events_collection.count_documents({})
diff --git a/bbot/test/test_step_2/module_tests/test_module_newsletters.py b/bbot/test/test_step_2/module_tests/test_module_newsletters.py
index e9b3c8fc60..3bbdce818d 100644
--- a/bbot/test/test_step_2/module_tests/test_module_newsletters.py
+++ b/bbot/test/test_step_2/module_tests/test_module_newsletters.py
@@ -1,11 +1,12 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 # import logging
 
 
 class TestNewsletters(ModuleTestBase):
-    found_tgt = "http://127.0.0.1:8888/found"
-    missing_tgt = "http://127.0.0.1:8888/missing"
+    found_tgt = f"{HTTPSERVER_URL}/found"
+    missing_tgt = f"{HTTPSERVER_URL}/missing"
     targets = [found_tgt, missing_tgt]
     modules_overrides = ["speculate", "http", "newsletters"]
 
diff --git a/bbot/test/test_step_2/module_tests/test_module_ntlm.py b/bbot/test/test_step_2/module_tests/test_module_ntlm.py
index 2f47f5ce71..b501c60b62 100644
--- a/bbot/test/test_step_2/module_tests/test_module_ntlm.py
+++ b/bbot/test/test_step_2/module_tests/test_module_ntlm.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestNTLM(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "ntlm"]
     config_overrides = {"modules": {"ntlm": {"try_all": True}}}
 
diff --git a/bbot/test/test_step_2/module_tests/test_module_nuclei.py b/bbot/test/test_step_2/module_tests/test_module_nuclei.py
index 88f0e2a01e..1274a0c090 100644
--- a/bbot/test/test_step_2/module_tests/test_module_nuclei.py
+++ b/bbot/test/test_step_2/module_tests/test_module_nuclei.py
@@ -1,9 +1,10 @@
 from ...bbot_fixtures import *
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL, BBOT_TEST_DIR
 
 
 class TestNucleiManual(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "nuclei"]
     config_overrides = {
         "web": {
@@ -16,13 +17,13 @@ class TestNucleiManual(ModuleTestBase):
                 "mode": "manual",
                 "concurrency": 2,
                 "ratelimit": 10,
-                "templates": "/tmp/.bbot_test/tools/nuclei-state/templates/http/miscellaneous/",
+                "templates": f"{BBOT_TEST_DIR}/tools/nuclei-state/templates/http/miscellaneous/",
                 "directory_only": False,
             }
         },
     }
 
-    test_html = """
+    test_html = f"""
     html>
  <head>
   <title>Index of /test</title>
@@ -34,7 +35,7 @@ class TestNucleiManual(ModuleTestBase):
    <tr><th colspan="3"><hr></th></tr>
 <tr><td><a href="/">Parent Directory</a></td><td>&nbsp;</td><td align="right">  - </td></tr>
 </table>
-<address>Apache/2.4.38 (Debian) Server at http://127.0.0.1:8888/testmultipleruns.html</address>
+<address>Apache/2.4.38 (Debian) Server at {HTTPSERVER_URL}/testmultipleruns.html</address>
 </body></html>
 """
 
@@ -69,7 +70,7 @@ class TestNucleiSevere(TestNucleiManual):
             "nuclei": {
                 "mode": "severe",
                 "concurrency": 1,
-                "templates": "/tmp/.bbot_test/tools/nuclei-state/templates/http/vulnerabilities/generic/generic-env.yaml",
+                "templates": f"{BBOT_TEST_DIR}/tools/nuclei-state/templates/http/vulnerabilities/generic/generic-env.yaml",
             }
         },
         "interactsh_disable": True,
@@ -115,7 +116,7 @@ class TestNucleiBudget(TestNucleiManual):
                 "mode": "budget",
                 "concurrency": 1,
                 "tags": "spiderfoot",
-                "templates": "/tmp/.bbot_test/tools/nuclei-state/templates/exposed-panels/spiderfoot.yaml",
+                "templates": f"{BBOT_TEST_DIR}/tools/nuclei-state/templates/exposed-panels/spiderfoot.yaml",
             }
         },
     }
@@ -167,8 +168,8 @@ class TestNucleiEnvIsolation(TestNucleiManual):
     leaky_env = {
         "PDCP_API_KEY": "user-pdcp-key-must-not-leak",
         "PDCP_TEAM_ID": "user-team",
-        "XDG_CONFIG_HOME": "/tmp/.bbot_test/xdg-leak-config",
-        "XDG_CACHE_HOME": "/tmp/.bbot_test/xdg-leak-cache",
+        "XDG_CONFIG_HOME": f"{BBOT_TEST_DIR}/xdg-leak-config",
+        "XDG_CACHE_HOME": f"{BBOT_TEST_DIR}/xdg-leak-cache",
         "GITHUB_TOKEN": "ghp_usertoken",
         "GITHUB_TEMPLATE_REPO": "attacker/private-templates",
         "GITLAB_TOKEN": "glpat-usertoken",
diff --git a/bbot/test/test_step_2/module_tests/test_module_paramminer_getparams.py b/bbot/test/test_step_2/module_tests/test_module_paramminer_getparams.py
index 5c0aca69d7..ec931afc9f 100644
--- a/bbot/test/test_step_2/module_tests/test_module_paramminer_getparams.py
+++ b/bbot/test/test_step_2/module_tests/test_module_paramminer_getparams.py
@@ -1,4 +1,5 @@
 from .test_module_paramminer_headers import Paramminer_Headers, tempwordlist, helper
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestParamminer_Getparams(Paramminer_Headers):
@@ -121,7 +122,7 @@ class TestParamminer_Getparams_finish(Paramminer_Headers):
         "modules": {"paramminer_getparams": {"wordlist": tempwordlist(["canary", "canary2"]), "recycle_words": True}}
     }
 
-    targets = ["http://127.0.0.1:8888/test1.php", "http://127.0.0.1:8888/test2.php"]
+    targets = [f"{HTTPSERVER_URL}/test1.php", f"{HTTPSERVER_URL}/test2.php"]
 
     test_1_html = """
 <html><a href="/test2.php?abcd1234=foo">paramstest2</a></html>
@@ -165,20 +166,20 @@ def check(self, module_test, events):
         for e in events:
             if e.type == "WEB_PARAMETER":
                 if (
-                    "http://127.0.0.1:8888/test2.php" in e.data["url"]
+                    f"{HTTPSERVER_URL}/test2.php" in e.data["url"]
                     and "HTTP Extracted Parameter [abcd1234] (HTML Tags Submodule)" in e.data["description"]
                 ):
                     excavate_extracted_web_parameter = True
 
                 if (
-                    "http://127.0.0.1:8888/test1.php" in e.data["url"]
+                    f"{HTTPSERVER_URL}/test1.php" in e.data["url"]
                     and "[Paramminer] Getparam: [abcd1234] Reasons: [body] Reflection: [False]"
                     in e.data["description"]
                 ):
                     found_hidden_getparam_recycled = True
 
                 if (
-                    "http://127.0.0.1:8888/test2.php" in e.data["url"]
+                    f"{HTTPSERVER_URL}/test2.php" in e.data["url"]
                     and "[Paramminer] Getparam: [abcd1234] Reasons: [body] Reflection: [False]"
                     in e.data["description"]
                 ):
@@ -191,7 +192,7 @@ def check(self, module_test, events):
 
 
 class TestParamminer_Getparams_xmlspeculative(Paramminer_Headers):
-    targets = ["http://127.0.0.1:8888/"]
+    targets = [f"{HTTPSERVER_URL}/"]
     modules_overrides = ["http", "excavate", "paramminer_getparams"]
     config_overrides = {
         "modules": {
@@ -251,7 +252,7 @@ def check(self, module_test, events):
 
 
 class TestParamminer_Getparams_filter_static(TestParamminer_Getparams_finish):
-    targets = ["http://127.0.0.1:8888/test1.php", "http://127.0.0.1:8888/test2.pdf"]
+    targets = [f"{HTTPSERVER_URL}/test1.php", f"{HTTPSERVER_URL}/test2.pdf"]
 
     test_1_html = """
     <html><a href="/test2.pdf?abcd1234=foo">paramstest2</a></html>
@@ -265,19 +266,19 @@ def check(self, module_test, events):
         for e in events:
             if e.type == "WEB_PARAMETER":
                 if (
-                    "http://127.0.0.1:8888/test2.pdf" in e.data["url"]
+                    f"{HTTPSERVER_URL}/test2.pdf" in e.data["url"]
                     and "HTTP Extracted Parameter [abcd1234]" in e.data["description"]
                 ):
                     excavate_extracted_param = True
 
                 if (
-                    "http://127.0.0.1:8888/test1.php" in e.data["url"]
+                    f"{HTTPSERVER_URL}/test1.php" in e.data["url"]
                     and "[Paramminer] Getparam: [abcd1234]" in e.data["description"]
                 ):
                     paramminer_recycled_to_php = True
 
                 if (
-                    "http://127.0.0.1:8888/test2.pdf" in e.data["url"]
+                    f"{HTTPSERVER_URL}/test2.pdf" in e.data["url"]
                     and "[Paramminer] Getparam:" in e.data["description"]
                 ):
                     paramminer_bruted_pdf = True
diff --git a/bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py b/bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py
index 846efa177f..009eed66d6 100644
--- a/bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py
+++ b/bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py
@@ -1,10 +1,11 @@
 from bbot.core.helpers import helper
 
 from .base import ModuleTestBase, tempwordlist
+from bbot.test.worker import HTTPSERVER_HOSTPORT, HTTPSERVER_URL
 
 
 class Paramminer_Headers(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "paramminer_headers"]
     config_overrides = {"modules": {"paramminer_headers": {"wordlist": tempwordlist(["junkword1", "tracestate"])}}}
 
@@ -202,7 +203,7 @@ def check(self, module_test, events):
 class TestParamminerHeadersWildcardSkip(ModuleTestBase):
     """When the host is an HTTP wildcard, paramminer_headers should skip fuzzing entirely."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "paramminer_headers"]
     config_overrides = {"modules": {"paramminer_headers": {"wordlist": tempwordlist(["tracestate"])}}}
 
@@ -231,7 +232,7 @@ async def setup_after_prep(self, module_test):
         pm = module_test.scan.modules["paramminer_headers"]
 
         def make_wp(**kwargs):
-            defaults = {"host": "127.0.0.1:8888", "type": "GETPARAM", "original_value": "x"}
+            defaults = {"host": HTTPSERVER_HOSTPORT, "type": "GETPARAM", "original_value": "x"}
             defaults.update(kwargs)
             return module_test.scan.make_event(defaults, "WEB_PARAMETER", dummy=True)
 
@@ -252,14 +253,14 @@ def make_hr(url):
         # same endpoint, same param keys, different values (simulates lightfuzz probe cycling)
         hash_a, _ = pm._incoming_dedup_hash(
             make_wp(
-                url="http://127.0.0.1:8888/page?culture=probe_a&page=1",
+                url=f"{HTTPSERVER_URL}/page?culture=probe_a&page=1",
                 name="culture",
                 additional_params={"page": "1"},
             )
         )
         hash_b, _ = pm._incoming_dedup_hash(
             make_wp(
-                url="http://127.0.0.1:8888/page?culture=probe_b&page=2",
+                url=f"{HTTPSERVER_URL}/page?culture=probe_b&page=2",
                 name="culture",
                 additional_params={"page": "2"},
             )
@@ -269,7 +270,7 @@ def make_hr(url):
         # different param keys on same path -> distinct
         hash_c, _ = pm._incoming_dedup_hash(
             make_wp(
-                url="http://127.0.0.1:8888/page?culture=x&page=1&csrf=tok",
+                url=f"{HTTPSERVER_URL}/page?culture=x&page=1&csrf=tok",
                 name="culture",
                 additional_params={"page": "1", "csrf": "tok"},
             )
@@ -279,7 +280,7 @@ def make_hr(url):
         # different path, same keys -> distinct
         hash_d, _ = pm._incoming_dedup_hash(
             make_wp(
-                url="http://127.0.0.1:8888/other?culture=x&page=1",
+                url=f"{HTTPSERVER_URL}/other?culture=x&page=1",
                 name="culture",
                 additional_params={"page": "1"},
             )
@@ -289,7 +290,7 @@ def make_hr(url):
         # different focus name, same sibling keys (excavate emits one WP per param) -> distinct
         hash_e, _ = pm._incoming_dedup_hash(
             make_wp(
-                url="http://127.0.0.1:8888/page?culture=x&page=1",
+                url=f"{HTTPSERVER_URL}/page?culture=x&page=1",
                 name="page",
                 additional_params={"culture": "x"},
             )
@@ -297,8 +298,8 @@ def make_hr(url):
         assert hash_a != hash_e, "Different focus name with same siblings should produce different dedup hashes"
 
         # HTTP_RESPONSE events: same endpoint collapses regardless
-        hash_hr_a, _ = pm._incoming_dedup_hash(make_hr("http://127.0.0.1:8888/page"))
-        hash_hr_b, _ = pm._incoming_dedup_hash(make_hr("http://127.0.0.1:8888/page"))
+        hash_hr_a, _ = pm._incoming_dedup_hash(make_hr(f"{HTTPSERVER_URL}/page"))
+        hash_hr_b, _ = pm._incoming_dedup_hash(make_hr(f"{HTTPSERVER_URL}/page"))
         assert hash_hr_a == hash_hr_b, "HTTP_RESPONSE events for same endpoint should produce same dedup hash"
 
         # WEB_PARAMETER and HTTP_RESPONSE for same URL should NOT collide
diff --git a/bbot/test/test_step_2/module_tests/test_module_reflected_parameters.py b/bbot/test/test_step_2/module_tests/test_module_reflected_parameters.py
index f4e84855c7..4451bf4417 100644
--- a/bbot/test/test_step_2/module_tests/test_module_reflected_parameters.py
+++ b/bbot/test/test_step_2/module_tests/test_module_reflected_parameters.py
@@ -12,6 +12,7 @@
 
 from .test_module_paramminer_getparams import TestParamminer_Getparams
 from .test_module_paramminer_headers import helper
+from bbot.test.worker import HTTPSERVER_URL
 
 
 @pytest.mark.asyncio
@@ -36,7 +37,7 @@ async def fake_request(**kwargs):
 
 
 class TestReflected_parameters_fromexcavate(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "reflected_parameters", "excavate"]
 
     def request_handler(self, request):
diff --git a/bbot/test/test_step_2/module_tests/test_module_retirejs.py b/bbot/test/test_step_2/module_tests/test_module_retirejs.py
index 83ed5f7827..77f40ad361 100644
--- a/bbot/test/test_step_2/module_tests/test_module_retirejs.py
+++ b/bbot/test/test_step_2/module_tests/test_module_retirejs.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestRetireJS(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "retirejs"]
 
     # HTML page with vulnerable JavaScript libraries
@@ -96,7 +97,7 @@ def check(self, module_test, events):
         # Two out of the three URLs should be in the output
         # The third, non-vulnerable URL (lodash.min.js) is not output because it's a "special URL", and
         # nothing interesting has been discovered from it.
-        vuln_urls = {"http://127.0.0.1:8888/handlebars.min.js", "http://127.0.0.1:8888/jquery-3.4.1.min.js"}
+        vuln_urls = {f"{HTTPSERVER_URL}/handlebars.min.js", f"{HTTPSERVER_URL}/jquery-3.4.1.min.js"}
         assert {e.url for e in js_url_events} == vuln_urls, "Expected to find the vulnerable URLs in the output"
 
         # Check for FINDING events generated by retirejs
@@ -122,8 +123,8 @@ def has_vuln(library, version, cve, js_url):
             needle = f"library detected: {library} v{version}"
             return any(needle in d and cve in d and js_url in d for d in descriptions)
 
-        handlebars_found = has_vuln("handlebars", "4.0.5", "CVE-2019-20922", "http://127.0.0.1:8888/handlebars.min.js")
-        jquery_found = has_vuln("jquery", "3.4.1", "CVE-2020-11022", "http://127.0.0.1:8888/jquery-3.4.1.min.js")
+        handlebars_found = has_vuln("handlebars", "4.0.5", "CVE-2019-20922", f"{HTTPSERVER_URL}/handlebars.min.js")
+        jquery_found = has_vuln("jquery", "3.4.1", "CVE-2020-11022", f"{HTTPSERVER_URL}/jquery-3.4.1.min.js")
 
         assert handlebars_found and jquery_found, (
             f"Expected to find specific vulnerabilities but didn't find them. Found descriptions:\n{all_descriptions}"
@@ -134,7 +135,7 @@ def has_vuln(library, version, cve, js_url):
             assert "description" in finding.data, "Finding should have description"
             assert "url" in finding.data, "Finding should have url"
             # url field should point to the page that loaded the JS, not the JS file itself
-            assert finding.data["url"] == "http://127.0.0.1:8888/", "url should be the parent page URL"
+            assert finding.data["url"] == f"{HTTPSERVER_URL}/", "url should be the parent page URL"
             assert finding.parent.type == "URL_UNVERIFIED", "Parent should be URL_UNVERIFIED"
             # severity should always be INFO; the CVE severity belongs in the description only
             assert finding.data["severity"] == "INFO", (
@@ -143,7 +144,7 @@ def has_vuln(library, version, cve, js_url):
 
 
 class TestRetireJSNoExcavate(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "retirejs"]
     force_start = True  # Allow scan to continue even if modules fail setup
     config_overrides = {
diff --git a/bbot/test/test_step_2/module_tests/test_module_robots.py b/bbot/test/test_step_2/module_tests/test_module_robots.py
index 667db93d26..ef605731ce 100644
--- a/bbot/test/test_step_2/module_tests/test_module_robots.py
+++ b/bbot/test/test_step_2/module_tests/test_module_robots.py
@@ -1,9 +1,10 @@
 import re
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_PORT, HTTPSERVER_URL
 
 
 class TestRobots(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "robots"]
     config_overrides = {"modules": {"robots": {"include_sitemap": True}}}
 
@@ -24,16 +25,16 @@ def check(self, module_test, events):
             if e.type == "URL_UNVERIFIED":
                 if str(e.module) != "SEED":
                     assert "spider-danger" in e.tags, f"{e} doesn't have spider-danger tag"
-                if e.url == "http://127.0.0.1:8888/allow/":
+                if e.url == f"{HTTPSERVER_URL}/allow/":
                     allow_bool = True
 
-                if e.url == "http://127.0.0.1:8888/disallow/":
+                if e.url == f"{HTTPSERVER_URL}/disallow/":
                     disallow_bool = True
 
-                if e.url == "http://127.0.0.1:8888/sitemap.txt":
+                if e.url == f"{HTTPSERVER_URL}/sitemap.txt":
                     sitemap_bool = True
 
-                if re.match(r"http://127\.0\.0\.1:8888/\w+/wildcard\.txt", e.url):
+                if re.match(rf"http://127\.0\.0\.1:{HTTPSERVER_PORT}/\w+/wildcard\.txt", e.url):
                     wildcard_bool = True
 
         assert allow_bool
diff --git a/bbot/test/test_step_2/module_tests/test_module_social.py b/bbot/test/test_step_2/module_tests/test_module_social.py
index b6d9016546..9699fa406c 100644
--- a/bbot/test/test_step_2/module_tests/test_module_social.py
+++ b/bbot/test/test_step_2/module_tests/test_module_social.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestSocial(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "social"]
 
     async def setup_after_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_speculate.py b/bbot/test/test_step_2/module_tests/test_module_speculate.py
index a4c77d6926..ab0dab3e48 100644
--- a/bbot/test/test_step_2/module_tests/test_module_speculate.py
+++ b/bbot/test/test_step_2/module_tests/test_module_speculate.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestSpeculate_Subdirectories(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/subdir1/subdir2/"]
+    targets = [f"{HTTPSERVER_URL}/subdir1/subdir2/"]
     modules_overrides = ["http", "speculate"]
 
     async def setup_before_prep(self, module_test):
@@ -19,7 +20,7 @@ async def setup_before_prep(self, module_test):
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
     def check(self, module_test, events):
-        assert any(e.type == "URL_UNVERIFIED" and e.url == "http://127.0.0.1:8888/subdir1/" for e in events)
+        assert any(e.type == "URL_UNVERIFIED" and e.url == f"{HTTPSERVER_URL}/subdir1/" for e in events)
 
 
 class TestSpeculate_OpenPorts(ModuleTestBase):
diff --git a/bbot/test/test_step_2/module_tests/test_module_sslcert.py b/bbot/test/test_step_2/module_tests/test_module_sslcert.py
index 791110ad88..a853c29984 100644
--- a/bbot/test/test_step_2/module_tests/test_module_sslcert.py
+++ b/bbot/test/test_step_2/module_tests/test_module_sslcert.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_SSL_HOSTPORT
 
 
 class TestSSLCert(ModuleTestBase):
-    targets = ["127.0.0.1:9999", "bbottest.notreal"]
+    targets = [HTTPSERVER_SSL_HOSTPORT, "bbottest.notreal"]
     config_overrides = {"scope": {"report_distance": 1}}
 
     def check(self, module_test, events):
diff --git a/bbot/test/test_step_2/module_tests/test_module_telerik.py b/bbot/test/test_step_2/module_tests/test_module_telerik.py
index c05ea8d06d..449060066a 100644
--- a/bbot/test/test_step_2/module_tests/test_module_telerik.py
+++ b/bbot/test/test_step_2/module_tests/test_module_telerik.py
@@ -1,9 +1,10 @@
 import re
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestTelerik(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888", "http://127.0.0.1:8888/telerik.aspx"]
+    targets = [HTTPSERVER_URL, f"{HTTPSERVER_URL}/telerik.aspx"]
     modules_overrides = ["http", "telerik"]
     config_overrides = {"modules": {"telerik": {"exploit_RAU_crypto": True}}}
 
@@ -123,7 +124,7 @@ def check(self, module_test, events):
 
 
 class TestTelerikDialogHandler_includesubdirs(TestTelerik):
-    targets = ["http://127.0.0.1:8888/", "http://127.0.0.1:8888/temp/"]
+    targets = [f"{HTTPSERVER_URL}/", f"{HTTPSERVER_URL}/temp/"]
     config_overrides = {
         "modules": {
             "telerik": {
diff --git a/bbot/test/test_step_2/module_tests/test_module_trufflehog.py b/bbot/test/test_step_2/module_tests/test_module_trufflehog.py
index bafa92d744..159cf2efe8 100644
--- a/bbot/test/test_step_2/module_tests/test_module_trufflehog.py
+++ b/bbot/test/test_step_2/module_tests/test_module_trufflehog.py
@@ -10,9 +10,10 @@
 
 from .base import ModuleTestBase
 from bbot.test.bbot_fixtures import bbot_test_dir
+from bbot.test.worker import HTTPSERVER_URL, BBOT_TEST_DIR, BBOT_TEST_DIR_NAME
 
 
-# Custom trufflehog detector that verifies against module_test.httpserver (127.0.0.1:8888),
+# Custom trufflehog detector that verifies against module_test.httpserver,
 # so the test doesn't depend on external network reachability.
 TRUFFLEHOG_VERIFY_PATH = "/trufflehog-verify"
 TRUFFLEHOG_VERIFIED_TOKEN = "aaaaaaaaaaaaaaaa"
@@ -24,7 +25,7 @@
     regex:
       key: 'BBOTTEST-([A-Za-z0-9]{{16}})'
     verify:
-      - endpoint: http://127.0.0.1:8888{TRUFFLEHOG_VERIFY_PATH}
+      - endpoint: {HTTPSERVER_URL}{TRUFFLEHOG_VERIFY_PATH}
         unsafe: true
 """
 
@@ -880,7 +881,7 @@ async def setup_before_prep(self, module_test):
                 },
             },
         )
-        temp_path = Path("/tmp/.bbot_test")
+        temp_path = Path(f"{BBOT_TEST_DIR}")
         tar_path = temp_path / "docker_pull_test.tar.gz"
         shutil.rmtree(tar_path, ignore_errors=True)
         with tarfile.open(tar_path, "w:gz") as tar:
@@ -1155,7 +1156,7 @@ async def setup_after_prep(self, module_test):
                 }
             },
         )
-        temp_path = Path("/tmp/.bbot_test")
+        temp_path = Path(f"{BBOT_TEST_DIR}")
         temp_repo_path = temp_path / "test_keys"
         shutil.rmtree(temp_repo_path, ignore_errors=True)
         subprocess.run(["git", "init", "test_keys"], cwd=temp_path)
@@ -1215,7 +1216,8 @@ def check(self, module_test, events):
             [
                 e
                 for e in filesystem_events
-                if e.data["path"].endswith("/git_repos/.bbot_test/test_keys") and Path(e.data["path"]).is_dir()
+                if e.data["path"].endswith(f"/git_repos/{BBOT_TEST_DIR_NAME}/test_keys")
+                and Path(e.data["path"]).is_dir()
             ]
         ), "Test keys repo dir does not exist"
         assert 1 == len(
@@ -1286,7 +1288,8 @@ def check(self, module_test, events):
             [
                 e
                 for e in filesystem_events
-                if e.data["path"].endswith("/git_repos/.bbot_test/test_keys") and Path(e.data["path"]).is_dir()
+                if e.data["path"].endswith(f"/git_repos/{BBOT_TEST_DIR_NAME}/test_keys")
+                and Path(e.data["path"]).is_dir()
             ]
         ), "Test keys repo dir does not exist"
         assert 1 == len(
@@ -1318,7 +1321,7 @@ def check(self, module_test, events):
 
 
 class TestTrufflehog_HTTPResponse(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "trufflehog"]
     config_overrides = {"modules": {"trufflehog": {"only_verified": False}}}
 
@@ -1330,13 +1333,13 @@ async def setup_before_prep(self, module_test):
     def check(self, module_test, events):
         findings = [e for e in events if e.type == "FINDING"]
         assert findings, "trufflehog produced no FINDING for HTTP_RESPONSE with a secret"
-        assert all(f.data.get("url", "").startswith("http://127.0.0.1:8888") for f in findings), (
+        assert all(f.data.get("url", "").startswith(HTTPSERVER_URL) for f in findings), (
             "FINDING must carry the source URL of the HTTP_RESPONSE, not a tempfile path"
         )
 
 
 class TestTrufflehog_RAWText(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888/test.pdf"]
+    targets = [f"{HTTPSERVER_URL}/test.pdf"]
     modules_overrides = ["http", "trufflehog", "filedownload", "kreuzberg"]
 
     download_dir = bbot_test_dir / "test_trufflehog_rawtext"
@@ -1366,7 +1369,7 @@ def check(self, module_test, events):
 class TestTrufflehog_JSSecretURL(ModuleTestBase):
     # A secret in a linked JS bundle must produce a FINDING whose url is the JS URL,
     # not the HTML URL and not a tempfile path.
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "excavate", "trufflehog"]
     config_overrides = {
         "modules": {"trufflehog": {"only_verified": False}},
@@ -1390,6 +1393,6 @@ async def setup_before_prep(self, module_test):
     def check(self, module_test, events):
         js_findings = [e for e in events if e.type == "FINDING" and "SlackWebhook" in e.data.get("description", "")]
         assert js_findings, "trufflehog produced no SlackWebhook FINDING from linked JS"
-        assert all(f.data.get("url", "") == "http://127.0.0.1:8888/app.js" for f in js_findings), (
+        assert all(f.data.get("url", "") == f"{HTTPSERVER_URL}/app.js" for f in js_findings), (
             f"FINDING must carry the JS URL, got: {[f.data.get('url') for f in js_findings]}"
         )
diff --git a/bbot/test/test_step_2/module_tests/test_module_unarchive.py b/bbot/test/test_step_2/module_tests/test_module_unarchive.py
index 147180d971..30e6ef039b 100644
--- a/bbot/test/test_step_2/module_tests/test_module_unarchive.py
+++ b/bbot/test/test_step_2/module_tests/test_module_unarchive.py
@@ -7,10 +7,11 @@
 from .base import ModuleTestBase
 
 from ...bbot_fixtures import *
+from bbot.test.worker import HTTPSERVER_URL, BBOT_TEST_DIR
 
 
 class TestUnarchive(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["filedownload", "http", "excavate", "speculate", "unarchive"]
     config_overrides = {
         "modules": {
@@ -21,7 +22,7 @@ class TestUnarchive(ModuleTestBase):
     }
 
     async def setup_after_prep(self, module_test):
-        temp_path = Path("/tmp/.bbot_test")
+        temp_path = Path(BBOT_TEST_DIR)
 
         # Create a text file to compress
         text_file = temp_path / "test.txt"
@@ -246,7 +247,7 @@ class TestUnarchiveTraversalCheck(ModuleTestBase):
 
     async def setup_after_prep(self, module_test):
         m = module_test.scan.modules["unarchive"]
-        temp_path = Path("/tmp/.bbot_test")
+        temp_path = Path(BBOT_TEST_DIR)
         temp_path.mkdir(exist_ok=True)
 
         # safe tar
diff --git a/bbot/test/test_step_2/module_tests/test_module_url_manipulation.py b/bbot/test/test_step_2/module_tests/test_module_url_manipulation.py
index 45a58c5f62..979b2af131 100644
--- a/bbot/test/test_step_2/module_tests/test_module_url_manipulation.py
+++ b/bbot/test/test_step_2/module_tests/test_module_url_manipulation.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestUrl_Manipulation(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "url_manipulation"]
     body = """
     <html>
@@ -34,6 +35,6 @@ def check(self, module_test, events):
         assert any(
             e.type == "FINDING"
             and e.data["description"]
-            == f"URL Manipulation: [body] Sig: [Modified URL: http://127.0.0.1:8888/?{module_test.module.rand_string}=.xml]"
+            == f"URL Manipulation: [body] Sig: [Modified URL: {HTTPSERVER_URL}/?{module_test.module.rand_string}=.xml]"
             for e in events
         )
diff --git a/bbot/test/test_step_2/module_tests/test_module_virtualhost.py b/bbot/test/test_step_2/module_tests/test_module_virtualhost.py
index 8ef3ad6e0e..0e1a7aef26 100644
--- a/bbot/test/test_step_2/module_tests/test_module_virtualhost.py
+++ b/bbot/test/test_step_2/module_tests/test_module_virtualhost.py
@@ -1,6 +1,14 @@
 from .base import ModuleTestBase, tempwordlist
 import re
 from werkzeug.wrappers import Response
+from bbot.test.worker import (
+    HTTPSERVER_HOSTPORT,
+    HTTPSERVER_PORT,
+    HTTPSERVER_URL,
+    LOCALHOST_HOSTPORT,
+    LOCALHOST_SSL_URL,
+    LOCALHOST_URL,
+)
 
 
 class VirtualhostTestBase(ModuleTestBase):
@@ -24,7 +32,7 @@ async def setup_after_prep(self, module_test):
 class TestVirtualhostSpecialHosts(VirtualhostTestBase):
     """Test special hosts detection"""
 
-    targets = ["http://localhost:8888"]
+    targets = [LOCALHOST_URL]
     modules_overrides = ["http", "virtualhost"]
     config_overrides = {
         "modules": {
@@ -53,7 +61,7 @@ class DummyModule(BaseModule):
             async def handle_event(self, event):
                 if event.type == "SCAN":
                     url_event = self.scan.make_event(
-                        "http://localhost:8888/",
+                        f"{LOCALHOST_URL}/",
                         "URL",
                         parent=event,
                         tags=["status-200", "ip-127.0.0.1"],
@@ -76,15 +84,15 @@ def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
         # Baseline request to localhost (with or without port)
-        if not host_header or host_header in ["localhost", "localhost:8888"]:
+        if not host_header or host_header in ["localhost", LOCALHOST_HOSTPORT]:
             return Response("baseline response from localhost", status=200)
 
         # Wildcard canary check
-        if re.match(r"[a-z]ocalhost(?::8888)?$", host_header):
+        if re.match(r"[a-z]ocalhost(?::" + str(HTTPSERVER_PORT) + r")?$", host_header):
             return Response("different wildcard response", status=404)
 
         # Random canary requests (12 lowercase letters .com)
-        if re.match(r"^[a-z]{12}\.com(?::8888)?$", host_header):
+        if re.match(r"^[a-z]{12}\.com(?::" + str(HTTPSERVER_PORT) + r")?$", host_header):
             return Response(
                 """<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
 <html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>Random canary host.</p></body></html>""",
@@ -133,7 +141,7 @@ def check(self, module_test, events):
 class TestVirtualhostBruteForce(VirtualhostTestBase):
     """Test subdomain brute-force detection using HTTP Host headers"""
 
-    targets = ["http://test.example:8888"]
+    targets = [f"http://test.example:{HTTPSERVER_PORT}"]
     modules_overrides = ["virtualhost"]  # Remove http, we'll manually create URL events
     test_wordlist = ["admin", "api", "test"]
     config_overrides = {
@@ -168,7 +176,10 @@ async def handle_event(self, event):
                 if event.type == "SCAN":
                     # Create and emit URL event for virtualhost module to process
                     url_event = self.scan.make_event(
-                        "http://test.example:8888/", "URL", parent=event, tags=["status-200", "ip-127.0.0.1"]
+                        f"http://test.example:{HTTPSERVER_PORT}/",
+                        "URL",
+                        parent=event,
+                        tags=["status-200", "ip-127.0.0.1"],
                     )
                     await self.emit_event(url_event)
 
@@ -192,7 +203,12 @@ def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
         # Baseline request to test.example or example (with or without port)
-        if not host_header or host_header in ["test.example", "test.example:8888", "example", "example:8888"]:
+        if not host_header or host_header in [
+            "test.example",
+            f"test.example:{HTTPSERVER_PORT}",
+            "example",
+            f"example:{HTTPSERVER_PORT}",
+        ]:
             return Response("baseline response from example baseline", status=200)
 
         # Wildcard canary check - change one character in test.example
@@ -200,15 +216,15 @@ def request_handler(self, request):
             return Response("wildcard canary different response", status=404)
 
         # Brute-force canary requests - random string + .test.example (with optional port)
-        if re.match(r"^[a-z]{12}\.test\.example(?::8888)?$", host_header):
+        if re.match(r"^[a-z]{12}\.test\.example(?::" + str(HTTPSERVER_PORT) + r")?$", host_header):
             return Response("subdomain canary response", status=404)
 
         # Brute-force matches on discovered basehost (admin|api|test).test.example (with optional port)
-        if host_header in ["admin.test.example", "admin.test.example:8888"]:
+        if host_header in ["admin.test.example", f"admin.test.example:{HTTPSERVER_PORT}"]:
             return Response("Admin panel found here!", status=200)
-        if host_header in ["api.test.example", "api.test.example:8888"]:
+        if host_header in ["api.test.example", f"api.test.example:{HTTPSERVER_PORT}"]:
             return Response("API endpoint found here!", status=200)
-        if host_header in ["test.test.example", "test.test.example:8888"]:
+        if host_header in ["test.test.example", f"test.test.example:{HTTPSERVER_PORT}"]:
             return Response("Test environment found here!", status=200)
 
         # Default response
@@ -228,7 +244,7 @@ def check(self, module_test, events):
 class TestVirtualhostMutations(VirtualhostTestBase):
     """Test host mutation detection using HTTP Host headers"""
 
-    targets = ["http://subdomain.target.test:8888"]
+    targets = [f"http://subdomain.target.test:{HTTPSERVER_PORT}"]
     modules_overrides = ["http", "virtualhost"]
     config_overrides = {
         "modules": {
@@ -275,7 +291,7 @@ class DummyModule(BaseModule):
             async def handle_event(self, event):
                 if event.type == "SCAN":
                     url_event = self.scan.make_event(
-                        "http://subdomain.target.test:8888/",
+                        f"http://subdomain.target.test:{HTTPSERVER_PORT}/",
                         "URL",
                         parent=event,
                         tags=["status-200", "ip-127.0.0.1"],
@@ -298,15 +314,17 @@ def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
         # Baseline request to target.test (with or without port)
-        if not host_header or host_header in ["subdomain.target.test", "subdomain.target.test:8888"]:
+        if not host_header or host_header in ["subdomain.target.test", f"subdomain.target.test:{HTTPSERVER_PORT}"]:
             return Response("baseline response from target.test", status=200)
 
         # Wildcard canary check
-        if re.match(r"[a-z]subdomain\.target\.test(?::8888)?$", host_header):  # Modified target.test
+        if re.match(
+            r"[a-z]subdomain\.target\.test(?::" + str(HTTPSERVER_PORT) + r")?$", host_header
+        ):  # Modified target.test
             return Response("wildcard canary response", status=404)
 
         # Mutation canary requests (4 chars + dash + original host)
-        if re.match(r"^[a-z]{4}-subdomain\.target\.test(?::8888)?$", host_header):
+        if re.match(r"^[a-z]{4}-subdomain\.target\.test(?::" + str(HTTPSERVER_PORT) + r")?$", host_header):
             return Response("<!DOCTYPE html><html><body>Mutation Canary</body></html>", status=404)
 
         # Word cloud mutation matches - return different content than canary
@@ -340,7 +358,7 @@ def check(self, module_test, events):
 class TestVirtualhostWordcloud(VirtualhostTestBase):
     """Test finish() wordcloud-based detection using HTTP Host headers"""
 
-    targets = ["http://wordcloud.test:8888"]
+    targets = [f"http://wordcloud.test:{HTTPSERVER_PORT}"]
     modules_overrides = ["http", "virtualhost"]
     config_overrides = {
         "modules": {
@@ -378,7 +396,7 @@ class DummyModule(BaseModule):
             async def handle_event(self, event):
                 if event.type == "SCAN":
                     url_event = self.scan.make_event(
-                        "http://wordcloud.test:8888/",
+                        f"http://wordcloud.test:{HTTPSERVER_PORT}/",
                         "URL",
                         parent=event,
                         tags=["status-200", "ip-127.0.0.1"],
@@ -401,23 +419,25 @@ def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
         # Baseline request to wordcloud.test (with or without port)
-        if not host_header or host_header in ["wordcloud.test", "wordcloud.test:8888"]:
+        if not host_header or host_header in ["wordcloud.test", f"wordcloud.test:{HTTPSERVER_PORT}"]:
             return Response("baseline response from wordcloud.test", status=200)
 
         # Wildcard canary check
-        if re.match(r"[a-z]ordcloud\.test(?::8888)?$", host_header):  # Modified wordcloud.test
+        if re.match(
+            r"[a-z]ordcloud\.test(?::" + str(HTTPSERVER_PORT) + r")?$", host_header
+        ):  # Modified wordcloud.test
             return Response("wildcard canary response", status=404)
 
         # Random canary requests (12 chars + .com)
-        if re.match(r"^[a-z]{12}\.com(?::8888)?$", host_header):
+        if re.match(r"^[a-z]{12}\.com(?::" + str(HTTPSERVER_PORT) + r")?$", host_header):
             return Response("random canary response", status=404)
 
         # Wordcloud-based matches - these are checked in finish()
-        if host_header in ["staging.wordcloud.test", "staging.wordcloud.test:8888"]:
+        if host_header in ["staging.wordcloud.test", f"staging.wordcloud.test:{HTTPSERVER_PORT}"]:
             return Response("Staging environment found!", status=200)
-        if host_header in ["prod.wordcloud.test", "prod.wordcloud.test:8888"]:
+        if host_header in ["prod.wordcloud.test", f"prod.wordcloud.test:{HTTPSERVER_PORT}"]:
             return Response("Production environment found!", status=200)
-        if host_header in ["dev.wordcloud.test", "dev.wordcloud.test:8888"]:
+        if host_header in ["dev.wordcloud.test", f"dev.wordcloud.test:{HTTPSERVER_PORT}"]:
             return Response("Development environment found!", status=200)
 
         # Default response
@@ -439,7 +459,7 @@ def check(self, module_test, events):
 class TestVirtualhostHTTPSLogic(ModuleTestBase):
     """Unit tests for HTTPS/SNI-specific functions"""
 
-    targets = ["http://localhost:8888"]  # Minimal target for unit testing
+    targets = [LOCALHOST_URL]  # Minimal target for unit testing
     modules_overrides = ["http", "virtualhost"]
 
     async def setup_before_prep(self, module_test):
@@ -479,7 +499,7 @@ def check(self, module_test, events):
 class TestVirtualhostForceBasehost(VirtualhostTestBase):
     """Test force_basehost functionality specifically"""
 
-    targets = ["http://127.0.0.1:8888"]  # Use IP to require force_basehost
+    targets = [HTTPSERVER_URL]  # Use IP to require force_basehost
     modules_overrides = ["http", "virtualhost"]
     test_wordlist = ["admin", "api"]
     config_overrides = {
@@ -501,11 +521,11 @@ def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
         # Baseline request to the IP
-        if not host_header or host_header == "127.0.0.1:8888":
+        if not host_header or host_header == HTTPSERVER_HOSTPORT:
             return Response("baseline response from IP", status=200)
 
         # Wildcard canary check
-        if re.match(r"[0-9]27\.0\.0\.1:8888", host_header):
+        if re.match(r"[0-9]27\.0\.0\.1:" + str(HTTPSERVER_PORT), host_header):
             return Response("wildcard canary response", status=404)
 
         # Subdomain canary (12 random chars + .forced.domain)
@@ -544,7 +564,7 @@ def check(self, module_test, events):
 class TestVirtualhostInterestingDefaultContent(VirtualhostTestBase):
     """Test reporting of interesting default canary content during wildcard check"""
 
-    targets = ["http://interesting.test:8888"]
+    targets = [f"http://interesting.test:{HTTPSERVER_PORT}"]
     modules_overrides = ["http", "virtualhost"]
     config_overrides = {
         "modules": {
@@ -577,7 +597,7 @@ class DummyModule(BaseModule):
             async def handle_event(self, event):
                 if event.type == "SCAN":
                     url_event = self.scan.make_event(
-                        "http://interesting.test:8888/",
+                        f"http://interesting.test:{HTTPSERVER_PORT}/",
                         "URL",
                         parent=event,
                         tags=["status-404", "ip-127.0.0.1"],
@@ -600,11 +620,11 @@ def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
         # Baseline response for original host (ensure status differs from canary)
-        if not host_header or host_header in ["interesting.test", "interesting.test:8888"]:
+        if not host_header or host_header in ["interesting.test", f"interesting.test:{HTTPSERVER_PORT}"]:
             return Response("baseline not found", status=404)
 
         # Wildcard canary mutated hostname: change first alpha to 'z' -> znteresting.test
-        if host_header in ["znteresting.test", "znteresting.test:8888"]:
+        if host_header in ["znteresting.test", f"znteresting.test:{HTTPSERVER_PORT}"]:
             long_body = (
                 "This is a sufficiently long default page body that exceeds forty characters "
                 "to trigger the interesting default content branch."
@@ -634,7 +654,7 @@ def check(self, module_test, events):
 class TestVirtualhostKeywordWildcard(VirtualhostTestBase):
     """Test keyword-based wildcard detection using 'www' in hostname"""
 
-    targets = ["http://acme.test:8888"]
+    targets = [f"http://acme.test:{HTTPSERVER_PORT}"]
     modules_overrides = ["http", "virtualhost"]
     config_overrides = {
         "modules": {
@@ -686,7 +706,7 @@ class DummyModule(BaseModule):
             async def handle_event(self, event):
                 if event.type == "SCAN":
                     url_event = self.scan.make_event(
-                        "http://acme.test:8888/",
+                        f"http://acme.test:{HTTPSERVER_PORT}/",
                         "URL",
                         parent=event,
                         tags=["status-404", "ip-127.0.0.1"],
@@ -708,7 +728,7 @@ def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
         # Baseline response for original host
-        if not host_header or host_header in ["acme.test", "acme.test:8888"]:
+        if not host_header or host_header in ["acme.test", f"acme.test:{HTTPSERVER_PORT}"]:
             return Response("baseline not found", status=404)
 
         # If hostname contains 'www' anywhere, return the same body as baseline (simulating keyword wildcard)
@@ -716,7 +736,7 @@ def request_handler(self, request):
             return Response("baseline not found", status=404)
 
         # Exact-match virtual host that should still be detected
-        if host_header in ["admin.acme.test", "admin.acme.test:8888"]:
+        if host_header in ["admin.acme.test", f"admin.acme.test:{HTTPSERVER_PORT}"]:
             return Response("Admin portal", status=200)
 
         # Default
@@ -740,7 +760,7 @@ def check(self, module_test, events):
 class TestVirtualhostHTTPResponse(VirtualhostTestBase):
     """Test virtual host discovery with badsecrets analysis of HTTP_RESPONSE events"""
 
-    targets = ["http://secrets.test:8888"]
+    targets = [f"http://secrets.test:{HTTPSERVER_PORT}"]
     modules_overrides = ["virtualhost", "badsecrets"]
     test_wordlist = ["admin"]
     config_overrides = {
@@ -775,7 +795,10 @@ async def handle_event(self, event):
                 if event.type == "SCAN":
                     # Create and emit URL event for virtualhost module to process
                     url_event = self.scan.make_event(
-                        "http://secrets.test:8888/", "URL", parent=event, tags=["status-200", "ip-127.0.0.1"]
+                        f"http://secrets.test:{HTTPSERVER_PORT}/",
+                        "URL",
+                        parent=event,
+                        tags=["status-200", "ip-127.0.0.1"],
                     )
                     await self.emit_event(url_event)
 
@@ -799,7 +822,7 @@ def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
         # Baseline request to secrets.test (with or without port)
-        if not host_header or host_header in ["secrets.test", "secrets.test:8888"]:
+        if not host_header or host_header in ["secrets.test", f"secrets.test:{HTTPSERVER_PORT}"]:
             return Response("baseline response from secrets.test", status=200)
 
         # Wildcard canary check - change one character in secrets.test
@@ -807,11 +830,11 @@ def request_handler(self, request):
             return Response("wildcard canary different response", status=404)
 
         # Brute-force canary requests - random string + .secrets.test (with optional port)
-        if re.match(r"^[a-z]{12}\.secrets\.test(?::8888)?$", host_header):
+        if re.match(r"^[a-z]{12}\.secrets\.test(?::" + str(HTTPSERVER_PORT) + r")?$", host_header):
             return Response("subdomain canary response", status=404)
 
         # Virtual host with vulnerable JWT cookie and JWT in body - both using weak secret '1234' - this should trigger badsecrets twice
-        if host_header in ["admin.secrets.test", "admin.secrets.test:8888"]:
+        if host_header in ["admin.secrets.test", f"admin.secrets.test:{HTTPSERVER_PORT}"]:
             return Response(
                 "<html><body><p>Admin Panel</p><script>const session = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjMsInVzZXJuYW1lIjoiYWRtaW4iLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.03xPSXavrMk0HK4BD3_hPKgu3RLu6CmTSPGfrDx2qpg';</script></body></html>",
                 status=200,
@@ -900,7 +923,7 @@ class TestVirtualhostFinishNoneBaseline(VirtualhostTestBase):
     surfaced as: `'NoneType' object has no attribute 'status_code'`.
     """
 
-    targets = ["http://finishnone.test:8888"]
+    targets = [f"http://finishnone.test:{HTTPSERVER_PORT}"]
     modules_overrides = ["http", "virtualhost"]
     config_overrides = {
         "modules": {
@@ -956,7 +979,7 @@ class DummyModule(BaseModule):
             async def handle_event(self, event):
                 if event.type == "SCAN":
                     url_event = self.scan.make_event(
-                        "http://finishnone.test:8888/",
+                        f"http://finishnone.test:{HTTPSERVER_PORT}/",
                         "URL",
                         parent=event,
                         tags=["status-200", "ip-127.0.0.1"],
@@ -976,13 +999,13 @@ async def patched_handle_event(ev):
     def request_handler(self, request):
         host_header = request.headers.get("Host", "").lower()
 
-        if not host_header or host_header in ["finishnone.test", "finishnone.test:8888"]:
+        if not host_header or host_header in ["finishnone.test", f"finishnone.test:{HTTPSERVER_PORT}"]:
             return Response("baseline response from finishnone.test", status=200)
 
-        if re.match(r"[a-z]inishnone\.test(?::8888)?$", host_header):
+        if re.match(r"[a-z]inishnone\.test(?::" + str(HTTPSERVER_PORT) + r")?$", host_header):
             return Response("wildcard canary response", status=404)
 
-        if re.match(r"^[a-z]{12}\.com(?::8888)?$", host_header):
+        if re.match(r"^[a-z]{12}\.com(?::" + str(HTTPSERVER_PORT) + r")?$", host_header):
             return Response("random canary response", status=404)
 
         return Response("default response", status=404)
@@ -1002,7 +1025,7 @@ def check(self, module_test, events):
 class TestVirtualhostCertificateSANs(VirtualhostTestBase):
     """Exercise the certificate-SAN code path on HTTPS URL events."""
 
-    targets = ["https://localhost:9999"]
+    targets = [LOCALHOST_SSL_URL]
     modules_overrides = ["virtualhost"]
     config_overrides = {
         "modules": {
@@ -1046,7 +1069,7 @@ class DummyModule(BaseModule):
             async def handle_event(self, event):
                 if event.type == "SCAN":
                     url_event = self.scan.make_event(
-                        "https://localhost:9999/",
+                        f"{LOCALHOST_SSL_URL}/",
                         "URL",
                         parent=event,
                         tags=["status-200", "ip-127.0.0.1"],
@@ -1076,7 +1099,7 @@ class TestVirtualhostSkipsCdnWaf(VirtualhostTestBase):
     """filter_event must reject URLs tagged with any of the flat cloud-provider tags
     that cloudcheck emits (post-`Migrate cloudcheck to host_metadata` refactor)."""
 
-    targets = ["http://localhost:8888"]
+    targets = [LOCALHOST_URL]
     modules_overrides = ["virtualhost"]
 
     async def setup_after_prep(self, module_test):
@@ -1087,7 +1110,7 @@ async def check(self, module_test, events):
 
         for tag in ("cloudflare", "imperva", "akamai", "cloudfront"):
             url_event = module_test.scan.make_event(
-                "http://cdn-test.local:8888/",
+                f"http://cdn-test.local:{HTTPSERVER_PORT}/",
                 "URL",
                 parent=module_test.scan.root_event,
                 tags=[tag, "in-scope", "status-200"],
@@ -1096,7 +1119,7 @@ async def check(self, module_test, events):
             assert result is False, f"virtualhost must skip URL tagged {tag!r} (got {result!r})"
 
         untagged_event = module_test.scan.make_event(
-            "http://plain.local:8888/",
+            f"http://plain.local:{HTTPSERVER_PORT}/",
             "URL",
             parent=module_test.scan.root_event,
             tags=["in-scope", "status-200"],
diff --git a/bbot/test/test_step_2/module_tests/test_module_waf_bypass.py b/bbot/test/test_step_2/module_tests/test_module_waf_bypass.py
index 45bdbbb135..8140ebbcbd 100644
--- a/bbot/test/test_step_2/module_tests/test_module_waf_bypass.py
+++ b/bbot/test/test_step_2/module_tests/test_module_waf_bypass.py
@@ -1,4 +1,5 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_PORT
 from bbot.modules.base import BaseModule
 
 
@@ -41,7 +42,7 @@ async def handle_event(self, event):
             if event.data == "protected.test":
                 await self.helpers.sleep(0.5)
                 self.events_seen.append(event.data)
-                url = "http://protected.test:8888/"
+                url = f"http://protected.test:{HTTPSERVER_PORT}/"
                 url_event = self.scan.make_event(
                     url, "URL", parent=self.scan.root_event, tags=["cloudflare", "in-scope", "status-200"]
                 )
@@ -51,7 +52,7 @@ async def handle_event(self, event):
             elif event.data == "direct.test":
                 await self.helpers.sleep(0.5)
                 self.events_seen.append(event.data)
-                url = "http://direct.test:8888/"
+                url = f"http://direct.test:{HTTPSERVER_PORT}/"
                 url_event = self.scan.make_event(
                     url, "URL", parent=self.scan.root_event, tags=["in-scope", "status-200"]
                 )
@@ -131,7 +132,7 @@ def check(self, module_test, events):
         correct_description = [
             e
             for e in waf_bypass_events
-            if "WAF Bypass Confirmed - Direct IPs: 127.0.0.1 for http://protected.test:8888/. Similarity 100.00%"
+            if f"WAF Bypass Confirmed - Direct IPs: 127.0.0.1 for http://protected.test:{HTTPSERVER_PORT}/. Similarity 100.00%"
             in e.data["description"]
         ]
         assert correct_description, "Incorrect description"
diff --git a/bbot/test/test_step_2/module_tests/test_module_wafw00f.py b/bbot/test/test_step_2/module_tests/test_module_wafw00f.py
index b3065aac48..3c02f1311a 100644
--- a/bbot/test/test_step_2/module_tests/test_module_wafw00f.py
+++ b/bbot/test/test_step_2/module_tests/test_module_wafw00f.py
@@ -1,10 +1,11 @@
 from .base import ModuleTestBase
 
 from werkzeug.wrappers import Response
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestWafw00f(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "wafw00f"]
 
     async def setup_after_prep(self, module_test):
@@ -17,7 +18,7 @@ def check(self, module_test, events):
 
 
 class TestWafw00f_noredirect(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "wafw00f"]
 
     async def setup_after_prep(self, module_test):
@@ -33,7 +34,7 @@ def check(self, module_test, events):
 
 
 class TestWafw00f_genericdetection(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "wafw00f"]
 
     async def setup_after_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_wayback.py b/bbot/test/test_step_2/module_tests/test_module_wayback.py
index b37d0d4d57..1525b9d087 100644
--- a/bbot/test/test_step_2/module_tests/test_module_wayback.py
+++ b/bbot/test/test_step_2/module_tests/test_module_wayback.py
@@ -6,6 +6,7 @@
 from bbot.modules.wayback import wayback
 
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestWayback(ModuleTestBase):
@@ -30,7 +31,7 @@ async def setup_after_prep(self, module_test):
             url="http://web.archive.org/cdx/search/cdx?url=blacklanternsecurity.com&matchType=domain&output=json&fl=original&collapse=original&limit=100000&filter=!statuscode:404&filter=!statuscode:301&filter=!statuscode:302&filter=!mimetype:image/.*&filter=!mimetype:text/css&filter=!mimetype:warc/revisit",
             json=[
                 ["original"],
-                ["http://127.0.0.1:8888/page?foo=bar&baz=qux"],
+                [f"{HTTPSERVER_URL}/page?foo=bar&baz=qux"],
             ],
         )
         # serve a response on the local httpserver so the httpx binary gets a 200
@@ -367,7 +368,7 @@ async def setup_after_prep(self, module_test):
         # CDX returns a URL with a search parameter pointing at the local httpserver
         module_test.blasthttp_mock.add_response(
             url="http://web.archive.org/cdx/search/cdx?url=blacklanternsecurity.com&matchType=domain&output=json&fl=original&collapse=original&limit=100000&filter=!statuscode:404&filter=!statuscode:301&filter=!statuscode:302&filter=!mimetype:image/.*&filter=!mimetype:text/css&filter=!mimetype:warc/revisit",
-            json=[["original"], ["http://127.0.0.1:8888/?search=test"]],
+            json=[["original"], [f"{HTTPSERVER_URL}/?search=test"]],
         )
         # httpserver handles httpx verification and lightfuzz probes
         expect_args = re.compile("/")
diff --git a/bbot/test/test_step_2/module_tests/test_module_web_report.py b/bbot/test/test_step_2/module_tests/test_module_web_report.py
index af11083e16..77864945db 100644
--- a/bbot/test/test_step_2/module_tests/test_module_web_report.py
+++ b/bbot/test/test_step_2/module_tests/test_module_web_report.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestWebReport(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     modules_overrides = ["http", "dotnetnuke", "badsecrets", "web_report", "trufflehog"]
     config_overrides = {"modules": {"trufflehog": {"only_verified": False}}}
 
@@ -21,9 +22,9 @@ def check(self, module_test, events):
         assert "CONFIRMED" in report_content
         assert "Known Secret Found" in report_content
         assert (
-            """<h3>URL</h3>
+            f"""<h3>URL</h3>
 <ul>
-<li><strong>http://127.0.0.1:8888/</strong>"""
+<li><strong>{HTTPSERVER_URL}/</strong>"""
             in report_content
         )
         assert """Possible Secret Found. Detector Type: [PrivateKey]""" in report_content
diff --git a/bbot/test/test_step_2/module_tests/test_module_webbrute.py b/bbot/test/test_step_2/module_tests/test_module_webbrute.py
index deb75b8426..20431f1195 100644
--- a/bbot/test/test_step_2/module_tests/test_module_webbrute.py
+++ b/bbot/test/test_step_2/module_tests/test_module_webbrute.py
@@ -3,10 +3,11 @@
 from werkzeug.wrappers import Response
 
 from .base import ModuleTestBase, tempwordlist
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestWebBrute(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute"
     test_wordlist = ["11111111", "admin", "junkword1", "zzzjunkword2"]
     config_overrides = {
@@ -100,7 +101,7 @@ class TestWebBruteRedirectFalsePositive(ModuleTestBase):
     webbrute should detect that all redirect hits go to the same location
     and filter them as false positives."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute"
     test_wordlist = ["~joe", "~", "junkword1", "zzzjunkword2"]
     config_overrides = {
@@ -134,7 +135,7 @@ class TestWebBruteWAFFalsePositive(ModuleTestBase):
     """WAF returns 200 with block page body for certain paths.
     webbrute should detect WAF content and filter these as false positives."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute"
     test_wordlist = ["admin", "secret", "junkword1", "zzzjunkword2"]
     config_overrides = {
@@ -174,7 +175,7 @@ class TestWebBruteDynamicContentFilter(ModuleTestBase):
     and report every 200 as a hit. HttpCompare should detect the token as a dynamic
     position and filter it out, only reporting /admin (genuinely different content)."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute"
     test_wordlist = ["admin", "junkword1", "zzzjunkword2"]
     config_overrides = {"modules": {"webbrute": {"wordlist": tempwordlist(test_wordlist)}}}
@@ -219,7 +220,7 @@ class TestWebBruteHitCap(ModuleTestBase):
     HttpCompare. The sqrt-scaled hit cap should detect this as a filtering
     failure and discard everything before emission."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute"
     # 50 words → cap of int(4 * sqrt(50)) = 28. All 50 will "hit", exceeding the cap.
     test_wordlist = [f"word{i:03d}" for i in range(50)]
@@ -256,7 +257,7 @@ class TestWebBruteCanaryDefense(ModuleTestBase):
     """Server returns unique content for EVERY path including random strings.
     The canary fires and aborts, discarding all hits."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute"
     test_wordlist = ["admin", "secret", "login"]
     config_overrides = {"modules": {"webbrute": {"wordlist": tempwordlist(test_wordlist)}}}
@@ -290,7 +291,7 @@ class TestWebBruteMidScanBaselineDrift(ModuleTestBase):
     """Server matches baseline initially, then drifts (WAF kicks in after N requests).
     Mid-scan baseline check should detect the drift and abort."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute"
     test_wordlist = ["admin", "secret", "login"]
     config_overrides = {"modules": {"webbrute": {"wordlist": tempwordlist(test_wordlist)}}}
@@ -322,7 +323,7 @@ def check(self, module_test, events):
 class TestWebBruteWildcardSkip(ModuleTestBase):
     """When the host is an HTTP wildcard, webbrute should skip fuzzing entirely."""
 
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute"
     test_wordlist = ["admin", "secret"]
     config_overrides = {"modules": {"webbrute": {"wordlist": tempwordlist(test_wordlist)}}}
diff --git a/bbot/test/test_step_2/module_tests/test_module_webbrute_shortnames.py b/bbot/test/test_step_2/module_tests/test_module_webbrute_shortnames.py
index 6a54cac4ae..732fa110f4 100644
--- a/bbot/test/test_step_2/module_tests/test_module_webbrute_shortnames.py
+++ b/bbot/test/test_step_2/module_tests/test_module_webbrute_shortnames.py
@@ -1,8 +1,9 @@
 from .base import ModuleTestBase
+from bbot.test.worker import HTTPSERVER_URL
 
 
 class TestWebBruteShortnames(ModuleTestBase):
-    targets = ["http://127.0.0.1:8888"]
+    targets = [HTTPSERVER_URL]
     module_name = "webbrute_shortnames"
     config_overrides = {
         "modules": {
@@ -20,7 +21,7 @@ async def setup_after_prep(self, module_test):
 
         seed_events = []
         parent_event = module_test.scan.make_event(
-            "http://127.0.0.1:8888/",
+            f"{HTTPSERVER_URL}/",
             "URL",
             module_test.scan.root_event,
             module="http",
@@ -28,7 +29,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/ADMINI~1.ASP",
+                f"{HTTPSERVER_URL}/ADMINI~1.ASP",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -37,7 +38,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/ADM_PO~1.ASP",
+                f"{HTTPSERVER_URL}/ADM_PO~1.ASP",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -46,7 +47,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/ABCZZZ~1.ASP",
+                f"{HTTPSERVER_URL}/ABCZZZ~1.ASP",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -55,7 +56,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/ABCXXX~1.ASP",
+                f"{HTTPSERVER_URL}/ABCXXX~1.ASP",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -64,7 +65,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/ABCYYY~1.ASP",
+                f"{HTTPSERVER_URL}/ABCYYY~1.ASP",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -73,7 +74,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/ABCCON~1.ASP",
+                f"{HTTPSERVER_URL}/ABCCON~1.ASP",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -82,7 +83,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/DIRECT~1",
+                f"{HTTPSERVER_URL}/DIRECT~1",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -91,7 +92,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/ADM_DI~1",
+                f"{HTTPSERVER_URL}/ADM_DI~1",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -100,7 +101,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/XYZDIR~1",
+                f"{HTTPSERVER_URL}/XYZDIR~1",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -109,7 +110,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/XYZAAA~1",
+                f"{HTTPSERVER_URL}/XYZAAA~1",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -118,7 +119,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/XYZBBB~1",
+                f"{HTTPSERVER_URL}/XYZBBB~1",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -127,7 +128,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/XYZCCC~1",
+                f"{HTTPSERVER_URL}/XYZCCC~1",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -136,7 +137,7 @@ async def setup_after_prep(self, module_test):
         )
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/SHORT~1.PL",
+                f"{HTTPSERVER_URL}/SHORT~1.PL",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -146,7 +147,7 @@ async def setup_after_prep(self, module_test):
 
         seed_events.append(
             module_test.scan.make_event(
-                "http://127.0.0.1:8888/newpro~1.asp",
+                f"{HTTPSERVER_URL}/newpro~1.asp",
                 "URL_HINT",
                 parent_event,
                 module="iis_shortnames",
@@ -200,21 +201,21 @@ def check(self, module_test, events):
 
         for e in events:
             if e.type == "URL_UNVERIFIED":
-                if e.url == "http://127.0.0.1:8888/administrator.aspx":
+                if e.url == f"{HTTPSERVER_URL}/administrator.aspx":
                     basic_detection = True
-                if e.url == "http://127.0.0.1:8888/directory/":
+                if e.url == f"{HTTPSERVER_URL}/directory/":
                     directory_detection = True
-                if e.url == "http://127.0.0.1:8888/adm_portal.aspx":
+                if e.url == f"{HTTPSERVER_URL}/adm_portal.aspx":
                     prefix_detection = True
-                if e.url == "http://127.0.0.1:8888/abcconsole.aspx":
+                if e.url == f"{HTTPSERVER_URL}/abcconsole.aspx":
                     delimiter_detection = True
-                if e.url == "http://127.0.0.1:8888/adm_directory/":
+                if e.url == f"{HTTPSERVER_URL}/adm_directory/":
                     directory_delimiter_detection = True
-                if e.url == "http://127.0.0.1:8888/xyzdirectory/":
+                if e.url == f"{HTTPSERVER_URL}/xyzdirectory/":
                     prefix_delimiter_detection = True
-                if e.url == "http://127.0.0.1:8888/short.pl":
+                if e.url == f"{HTTPSERVER_URL}/short.pl":
                     short_extensions_detection = True
-                if e.url == "http://127.0.0.1:8888/newproxy.aspx":
+                if e.url == f"{HTTPSERVER_URL}/newproxy.aspx":
                     subword_detection = True
 
         assert basic_detection
diff --git a/bbot/test/test_step_2/module_tests/test_module_websocket.py b/bbot/test/test_step_2/module_tests/test_module_websocket.py
index 0d3dcf1c30..26cd28ecd8 100644
--- a/bbot/test/test_step_2/module_tests/test_module_websocket.py
+++ b/bbot/test/test_step_2/module_tests/test_module_websocket.py
@@ -4,6 +4,7 @@
 from websockets.asyncio.server import serve
 
 from .base import ModuleTestBase
+from bbot.test.worker import WEBSOCKET_PORT
 
 log = logging.getLogger("bbot.testing")
 
@@ -18,12 +19,12 @@ async def websocket_handler(websocket):
 
 # Define a coroutine for the server
 async def server_coroutine():
-    async with serve(websocket_handler, "127.0.0.1", 8765) as server:
+    async with serve(websocket_handler, "127.0.0.1", WEBSOCKET_PORT) as server:
         await server.serve_forever()
 
 
 class TestWebsocket(ModuleTestBase):
-    config_overrides = {"modules": {"websocket": {"url": "ws://127.0.0.1:8765/testing"}}}
+    config_overrides = {"modules": {"websocket": {"url": f"ws://127.0.0.1:{WEBSOCKET_PORT}/testing"}}}
 
     async def setup_before_prep(self, module_test):
         self.server_task = asyncio.create_task(server_coroutine())
diff --git a/bbot/test/worker.py b/bbot/test/worker.py
new file mode 100644
index 0000000000..8901dc65fb
--- /dev/null
+++ b/bbot/test/worker.py
@@ -0,0 +1,106 @@
+"""Per-worker test resources: server ports and the BBOT home directory.
+
+Ports and the home directory are process-global, so under ``pytest -n`` each
+worker needs its own: otherwise the servers collide on one port, and whichever
+worker finishes first deletes the home directory out from under the rest.
+
+Serial runs have no ``PYTEST_XDIST_WORKER`` and keep the original values.
+"""
+
+import os
+from contextlib import suppress
+from pathlib import Path
+
+# Wider than the number of distinct base ports, so worker blocks cannot overlap.
+WORKER_PORT_STRIDE = 100
+
+BASE_BBOT_TEST_DIR = Path("/tmp/.bbot_test")
+
+
+def worker_id():
+    worker = os.environ.get("PYTEST_XDIST_WORKER", "")
+    return worker if worker.startswith("gw") else ""
+
+
+# BBOTLogger only configures logging when _BBOT_LOGGING_SETUP is unset, so that
+# bbot subprocesses reuse the parent's setup. Workers inherit the variable and
+# so skipped setup entirely, leaving debug.log empty. Clear it before bbot.core
+# is imported; BBOTLogger sets it again, so this worker's subprocesses still
+# inherit it.
+if worker_id():
+    os.environ.pop("_BBOT_LOGGING_SETUP", None)
+
+
+def _worker_index():
+    worker = worker_id()
+    if worker:
+        with suppress(ValueError):
+            return int(worker[2:])
+    return 0
+
+
+def worker_port(base):
+    return base + (_worker_index() * WORKER_PORT_STRIDE)
+
+
+def worker_dir(base=BASE_BBOT_TEST_DIR):
+    worker = worker_id()
+    return Path(f"{base}_{worker}") if worker else Path(base)
+
+
+HTTPSERVER_PORT = worker_port(8888)
+HTTPSERVER_SSL_PORT = worker_port(9999)
+HTTPSERVER_ALLINTERFACES_PORT = worker_port(5556)
+FASTAPI_PORT = worker_port(8978)
+WEBSOCKET_PORT = worker_port(8765)
+
+# The scope-accuracy test binds distinct loopback IPs (127.0.0.77, .88, ...),
+# which is still the same port on every worker, so it moves with the worker too.
+# Inside the stride block, so it cannot reach the next worker's range.
+HTTPSERVER_PORT_ALT = HTTPSERVER_PORT + 1
+
+HTTPSERVER_HOSTPORT = f"127.0.0.1:{HTTPSERVER_PORT}"
+HTTPSERVER_SSL_HOSTPORT = f"127.0.0.1:{HTTPSERVER_SSL_PORT}"
+HTTPSERVER_URL = f"http://{HTTPSERVER_HOSTPORT}"
+HTTPSERVER_SSL_URL = f"https://{HTTPSERVER_SSL_HOSTPORT}"
+
+# Distinct from the 127.0.0.1 forms: virtualhost asserts on the Host header,
+# where "localhost:8888" and "127.0.0.1:8888" are not interchangeable.
+LOCALHOST_HOSTPORT = f"localhost:{HTTPSERVER_PORT}"
+LOCALHOST_URL = f"http://{LOCALHOST_HOSTPORT}"
+LOCALHOST_SSL_URL = f"https://localhost:{HTTPSERVER_SSL_PORT}"
+
+FASTAPI_URL = f"http://127.0.0.1:{FASTAPI_PORT}"
+
+BBOT_TEST_DIR = worker_dir()
+# git_clone writes to git_repos/<home name>/<repo>, so tests asserting on those
+# paths need the basename, not a hardcoded ".bbot_test".
+BBOT_TEST_DIR_NAME = BBOT_TEST_DIR.name
+
+# Bounded so a container that dies on startup fails fast instead of hanging the
+# run until the global pytest timeout.
+CONTAINER_READY_TIMEOUT = int(os.environ.get("BBOT_TEST_CONTAINER_TIMEOUT", "180"))
+
+_OOM_HINT = "A container that exits with code 137 was OOM-killed; it competes with the other test workers for memory."
+
+
+async def wait_for_container(name, connect, timeout=CONTAINER_READY_TIMEOUT):
+    """Retry ``connect`` until it succeeds, or raise once ``timeout`` elapses.
+
+    ``connect`` may be sync or async. Returns whatever it returns.
+    """
+    import asyncio
+    import inspect
+    import time
+
+    deadline = time.time() + timeout
+    while True:
+        try:
+            result = connect()
+            return await result if inspect.isawaitable(result) else result
+        except Exception as e:
+            if time.time() > deadline:
+                raise RuntimeError(
+                    f"{name} did not become ready within {timeout}s. {_OOM_HINT} Last error: {e}"
+                ) from e
+            await asyncio.sleep(0.5)
diff --git a/bbot/test/worker_count.py b/bbot/test/worker_count.py
new file mode 100644
index 0000000000..754a2b2432
--- /dev/null
+++ b/bbot/test/worker_count.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Print the number of pytest-xdist workers to use.
+
+Bounded by cores *and* memory. `-n logical` is wrong on a box with many cores
+relative to RAM: each worker holds roughly 700MB once warm, and elasticsearch
+wants ~2GB on top, so a 16-core/16GB machine running 16 workers gets its
+container OOM-killed (exit 137) and takes the run down with it.
+
+Override with BBOT_TEST_WORKERS=<n>.
+"""
+
+import os
+
+MB_PER_WORKER = 700
+# Docker-backed services (elasticsearch ~2GB), the daemon, and the pytest parent.
+RESERVE_MB = 5120
+
+
+def cpu_count():
+    # sched_getaffinity respects cgroup/taskset limits; os.cpu_count() does not.
+    try:
+        return len(os.sched_getaffinity(0))
+    except AttributeError:
+        return os.cpu_count() or 1
+
+
+def worker_count():
+    pinned = os.environ.get("BBOT_TEST_WORKERS", "").strip()
+    if pinned:
+        return max(1, int(pinned))
+    try:
+        total_mb = os.sysconf("SC_PAGE_SIZE") * os.sysconf("SC_PHYS_PAGES") // (1024 * 1024)
+    except (ValueError, OSError, AttributeError):
+        return cpu_count()
+    return max(1, min(cpu_count(), (total_mb - RESERVE_MB) // MB_PER_WORKER))
+
+
+if __name__ == "__main__":
+    print(worker_count())
diff --git a/pyproject.toml b/pyproject.toml
index fca08c78dd..61b2527bab 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -79,6 +79,7 @@ dev = [
     "fastapi>=0.115.5,<0.141.0",
     "pytest-httpx>=0.35",
     "pytest-benchmark>=4,<6",
+    "pytest-xdist>=3.6,<4",
     "baddns~=2.4.1",
     "ruff==0.15.22",
     "maturin>=1.4,<2",
diff --git a/uv.lock b/uv.lock
index 170b6c7077..3d9f0ad58c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -33,11 +33,11 @@ resolution-markers = [
     "python_full_version < '3.11'",
 ]
 dependencies = [
-    { name = "cryptography", marker = "python_full_version < '3.11'" },
-    { name = "jinja2", marker = "python_full_version < '3.11'" },
-    { name = "packaging", marker = "python_full_version < '3.11'" },
-    { name = "pyyaml", marker = "python_full_version < '3.11'" },
-    { name = "resolvelib", version = "1.0.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "cryptography" },
+    { name = "jinja2" },
+    { name = "packaging" },
+    { name = "pyyaml" },
+    { name = "resolvelib", version = "1.0.1", source = { registry = "https://pypi.org/simple" } },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/ff/80/2925a0564f6f99a8002c3be3885b83c3a1dc5f57ebf00163f528889865f5/ansible_core-2.17.14.tar.gz", hash = "sha256:7c17fee39f8c29d70e3282a7e9c10bd70d5cd4fd13ddffc5dcaa52adbd142ff8", size = 3119687, upload-time = "2025-09-08T18:28:03.158Z" }
 wheels = [
@@ -52,11 +52,11 @@ resolution-markers = [
     "python_full_version == '3.11.*'",
 ]
 dependencies = [
-    { name = "cryptography", marker = "python_full_version == '3.11.*'" },
-    { name = "jinja2", marker = "python_full_version == '3.11.*'" },
-    { name = "packaging", marker = "python_full_version == '3.11.*'" },
-    { name = "pyyaml", marker = "python_full_version == '3.11.*'" },
-    { name = "resolvelib", version = "1.2.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
+    { name = "cryptography" },
+    { name = "jinja2" },
+    { name = "packaging" },
+    { name = "pyyaml" },
+    { name = "resolvelib", version = "1.2.1", source = { registry = "https://pypi.org/simple" } },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/8b/98/ca1135c50aa3004367ff1f66c101a565ac17b4bfa1c9f9a2d8e395e06775/ansible_core-2.19.6.tar.gz", hash = "sha256:1e6b711e357901422592a1d1e4a076eee918497587646a5843fa61536ede1990", size = 3414480, upload-time = "2026-01-29T19:24:10.09Z" }
 wheels = [
@@ -71,11 +71,11 @@ resolution-markers = [
     "python_full_version >= '3.12'",
 ]
 dependencies = [
-    { name = "cryptography", marker = "python_full_version >= '3.12'" },
-    { name = "jinja2", marker = "python_full_version >= '3.12'" },
-    { name = "packaging", marker = "python_full_version >= '3.12'" },
-    { name = "pyyaml", marker = "python_full_version >= '3.12'" },
-    { name = "resolvelib", version = "1.2.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
+    { name = "cryptography" },
+    { name = "jinja2" },
+    { name = "packaging" },
+    { name = "pyyaml" },
+    { name = "resolvelib", version = "1.2.1", source = { registry = "https://pypi.org/simple" } },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/22/56/a76adc20dee854b52a3e20fcb9c01280bbac52ef54308e5b1c7bc67ade76/ansible_core-2.20.2.tar.gz", hash = "sha256:75e19a3ad8cf659579ea182cdf948ee0900d700e564802e92876de53dbd9715d", size = 3317427, upload-time = "2026-01-29T19:25:04.814Z" }
 wheels = [
@@ -238,6 +238,7 @@ dev = [
     { name = "pytest-httpx" },
     { name = "pytest-rerunfailures" },
     { name = "pytest-timeout" },
+    { name = "pytest-xdist" },
     { name = "ruff" },
     { name = "urllib3" },
     { name = "uvicorn" },
@@ -311,6 +312,7 @@ dev = [
     { name = "pytest-httpx", specifier = ">=0.35" },
     { name = "pytest-rerunfailures", specifier = ">=14,<17" },
     { name = "pytest-timeout", specifier = ">=2.3.1,<3" },
+    { name = "pytest-xdist", specifier = ">=3.6,<4" },
     { name = "ruff", specifier = "==0.15.22" },
     { name = "urllib3", specifier = ">=2.0.2,<3" },
     { name = "uvicorn", specifier = ">=0.32,<0.52" },
@@ -1140,13 +1142,22 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
+    { name = "typing-extensions" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/8a/0e/97c33bf5009bdbac74fd2beace167cab3f978feb69cc36f1ef79360d6c4e/exceptiongroup-1.3.1-py3-none-any.whl", hash = "sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598", size = 16740, upload-time = "2025-11-21T23:01:53.443Z" },
 ]
 
+[[package]]
+name = "execnet"
+version = "2.1.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bf/89/780e11f9588d9e7128a3f87788354c7946a9cbb1401ad38a48c4db9a4f07/execnet-2.1.2.tar.gz", hash = "sha256:63d83bfdd9a23e35b9c6a3261412324f964c2ec8dcd8d3c6916ee9373e0befcd", size = 166622, upload-time = "2025-11-12T09:56:37.75Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ab/84/02fc1827e8cdded4aa65baef11296a9bbe595c474f0d6d758af082d849fd/execnet-2.1.2-py3-none-any.whl", hash = "sha256:67fba928dd5a544b783f6056f449e5e3931a5c378b128bc18501f7ea79e296ec", size = 40708, upload-time = "2025-11-12T09:56:36.333Z" },
+]
+
 [[package]]
 name = "fastapi"
 version = "0.140.0"
@@ -2432,6 +2443,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/fa/b6/3127540ecdf1464a00e5a01ee60a1b09175f6913f0644ac748494d9c4b21/pytest_timeout-2.4.0-py3-none-any.whl", hash = "sha256:c42667e5cdadb151aeb5b26d114aff6bdf5a907f176a007a30b940d3d865b5c2", size = 14382, upload-time = "2025-05-05T19:44:33.502Z" },
 ]
 
+[[package]]
+name = "pytest-xdist"
+version = "3.8.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "execnet" },
+    { name = "pytest" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/78/b4/439b179d1ff526791eb921115fca8e44e596a13efeda518b9d845a619450/pytest_xdist-3.8.0.tar.gz", hash = "sha256:7e578125ec9bc6050861aa93f2d59f1d8d085595d6551c2c90b6f4fad8d3a9f1", size = 88069, upload-time = "2025-07-01T13:30:59.346Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ca/31/d4e37e9e550c2b92a9cbc2e4d0b7420a27224968580b5a447f420847c975/pytest_xdist-3.8.0-py3-none-any.whl", hash = "sha256:202ca578cfeb7370784a8c33d6d05bc6e13b4f25b5053c30a152269fd10f0b88", size = 46396, upload-time = "2025-07-01T13:30:56.632Z" },
+]
+
 [[package]]
 name = "python-daemon"
 version = "3.1.2"