diff --git a/core/service_probe.go b/core/service_probe.go
index 693bbe0..6335cf3 100644
--- a/core/service_probe.go
+++ b/core/service_probe.go
@@ -392,6 +392,10 @@ func (i *Info) tryProbes(response []byte, probes []*Probe) bool {
 
 // GetInfo 分析响应数据并提取服务信息
 func (i *Info) GetInfo(response []byte, probe *Probe) {
+	if probe == nil {
+		return
+	}
+
 	// 响应数据有效性检查
 	if len(response) <= 0 {
 		common.LogDebug(i18n.GetText("service_probe_empty_response"))
diff --git a/plugins/web/webtitle.go b/plugins/web/webtitle.go
index 6c192ba..825e049 100644
--- a/plugins/web/webtitle.go
+++ b/plugins/web/webtitle.go
@@ -270,6 +270,7 @@ func (p *WebTitlePlugin) identifyFingerprintsMulti(ctx context.Context, info *co
 
 	// 非全量模式下，基于指纹触发POC扫描
 	if !config.POC.Full && !config.POC.Disabled {
+		info.URL = baseURL
 		p.triggerPocScan(ctx, info, fingerprints, config, session)
 	}
 
diff --git a/webscan/pocs/test-nuclei-example.yaml b/webscan/pocs/test-nuclei-example.yaml
deleted file mode 100644
index e48b4f1..0000000
--- a/webscan/pocs/test-nuclei-example.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-id: test-nuclei-example
-info:
-  name: Test Nuclei Example Template
-  author: fscan-dev
-  severity: info
-  description: |
-    This is a test template to demonstrate Nuclei format support in fscan.
-    It will be automatically converted to fscan format during loading.
-  reference:
-    - https://github.com/shadow1ng/fscan
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/robots.txt"
-
-    matchers:
-      - type: word
-        words:
-          - "User-agent"
-          - "Disallow"
-        condition: and
-
-      - type: status
-        status:
-          - 200
diff --git a/webscan/web_scan.go b/webscan/web_scan.go
index 84bfc1e..6dbdfb1 100644
--- a/webscan/web_scan.go
+++ b/webscan/web_scan.go
@@ -97,7 +97,11 @@ func WebScan(ctx context.Context, info *common.HostInfo, cfg *common.Config, ses
 func buildTargetURL(info *common.HostInfo) (string, error) {
 	// 自动构建URL
 	if info.URL == "" {
-		info.URL = protocolHTTP + net.JoinHostPort(info.Host, fmt.Sprint(info.Port))
+		protocol := protocolHTTP
+		if isTLSPort(info.Port) {
+			protocol = protocolHTTPS
+		}
+		info.URL = protocol + net.JoinHostPort(info.Host, fmt.Sprint(info.Port))
 	} else if !hasProtocolPrefix(info.URL) {
 		info.URL = protocolHTTP + normalizeSchemelessWebTarget(info.URL)
 	}
@@ -132,6 +136,15 @@ func hasProtocolPrefix(urlStr string) bool {
 	return strings.HasPrefix(urlStr, protocolHTTP) || strings.HasPrefix(urlStr, protocolHTTPS)
 }
 
+func isTLSPort(port int) bool {
+	switch port {
+	case 443, 8443, 4443, 9443:
+		return true
+	default:
+		return false
+	}
+}
+
 func normalizeSchemelessWebTarget(rawURL string) string {
 	authority := rawURL
 	suffix := ""