diff --git a/compat/module.go b/compat/module.go
index ea5fcd69..c159d02f 100644
--- a/compat/module.go
+++ b/compat/module.go
@@ -2,6 +2,7 @@ package compat
 
 import (
 	"context"
+	"errors"
 	"time"
 
 	"github.com/tevino/abool"
@@ -92,6 +93,9 @@ func selfcheckTaskFunc(ctx context.Context, task *modules.Task) error {
 	case err == nil:
 		// Successful.
 		tracer.Debugf("compat: self-check successful")
+	case errors.Is(err, errSelfcheckSkipped):
+		// Skipped.
+		tracer.Debugf("compat: %s", err)
 	case issue == nil:
 		// Internal error.
 		tracer.Warningf("compat: %s", err)
diff --git a/compat/selfcheck.go b/compat/selfcheck.go
index fd4a22bc..e26c1ed5 100644
--- a/compat/selfcheck.go
+++ b/compat/selfcheck.go
@@ -3,6 +3,7 @@ package compat
 import (
 	"context"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"net"
 	"strings"
@@ -11,6 +12,7 @@ import (
 
 	"github.com/safing/portbase/log"
 	"github.com/safing/portbase/rng"
+	"github.com/safing/portmaster/netenv"
 	"github.com/safing/portmaster/network/packet"
 	"github.com/safing/portmaster/resolver"
 )
@@ -36,12 +38,19 @@ var (
 	dnsCheckWaitDuration        = 45 * time.Second
 	dnsCheckAnswerLock          sync.Mutex
 	dnsCheckAnswer              net.IP
+
+	errSelfcheckSkipped = errors.New("self-check skipped")
 )
 
 func selfcheck(ctx context.Context) (issue *systemIssue, err error) {
 	selfcheckLock.Lock()
 	defer selfcheckLock.Unlock()
 
+	// Step 0: Check if self-check makes sense.
+	if !netenv.Online() {
+		return nil, fmt.Errorf("%w: device is offline or in limited network", errSelfcheckSkipped)
+	}
+
 	// Step 1: Check if the system integration sees a packet.
 
 	// Empty recv channel.
diff --git a/netenv/online-status.go b/netenv/online-status.go
index 8be03a59..7ec4a3f4 100644
--- a/netenv/online-status.go
+++ b/netenv/online-status.go
@@ -77,6 +77,7 @@ var (
 		"network-test.debian.org.",       // Debian
 		"204.pop-os.org.",                // Pop OS
 		"conncheck.opensuse.org.",        // OpenSUSE
+		"ping.archlinux.org",             // Arch
 		// There are probably a lot more domains for all the Linux Distro/DE Variants. Please raise issues and/or submit PRs!
 		// https://github.com/solus-project/budgie-desktop/issues/807
 		// https://www.lguruprasad.in/blog/2015/07/21/enabling-captive-portal-detection-in-gnome-3-14-on-debian-jessie/
@@ -434,7 +435,7 @@ func checkOnlineStatus(ctx context.Context) {
 
 	ipv4, ipv6, err := GetAssignedAddresses()
 	if err != nil {
-		log.Warningf("network: failed to get assigned network addresses: %s", err)
+		log.Warningf("netenv: failed to get assigned network addresses: %s", err)
 	} else {
 		var lan bool
 
diff --git a/network/reference/ports.go b/network/reference/ports.go
index 3c24826d..6f6873f5 100644
--- a/network/reference/ports.go
+++ b/network/reference/ports.go
@@ -14,8 +14,8 @@ var (
 		25:  "SMTP",
 		43:  "WHOIS",
 		53:  "DNS",
-		67:  "DHCP-SERVER",
-		68:  "DHCP-CLIENT",
+		67:  "DHCP_SERVER",
+		68:  "DHCP_CLIENT",
 		69:  "TFTP",
 		80:  "HTTP",
 		110: "POP3",
@@ -27,10 +27,10 @@ var (
 		389: "LDAP",
 		443: "HTTPS",
 		445: "SMB",
-		587: "SMTP-ALT",
-		465: "SMTP-SSL",
-		993: "IMAP-SSL",
-		995: "POP3-SSL",
+		587: "SMTP_ALT",
+		465: "SMTP_SSL",
+		993: "IMAP_SSL",
+		995: "POP3_SSL",
 	}
 
 	portNumbers = map[string]uint16{
@@ -42,7 +42,9 @@ var (
 		"WHOIS":       43,
 		"DNS":         53,
 		"DHCP-SERVER": 67,
+		"DHCP_SERVER": 67,
 		"DHCP-CLIENT": 68,
+		"DHCP_CLIENT": 68,
 		"TFTP":        69,
 		"HTTP":        80,
 		"POP3":        110,
@@ -55,9 +57,13 @@ var (
 		"HTTPS":       443,
 		"SMB":         445,
 		"SMTP-ALT":    587,
+		"SMTP_ALT":    587,
 		"SMTP-SSL":    465,
+		"SMTP_SSL":    465,
 		"IMAP-SSL":    993,
+		"IMAP_SSL":    993,
 		"POP3-SSL":    995,
+		"POP3_SSL":    995,
 	}
 )
 
diff --git a/profile/binmeta/find_linux.go b/profile/binmeta/find_linux.go
index bf4357d7..b6e7816a 100644
--- a/profile/binmeta/find_linux.go
+++ b/profile/binmeta/find_linux.go
@@ -77,7 +77,8 @@ func searchDirectory(directory string, binPath string) (iconPath string, err err
 		}
 		return "", fmt.Errorf("failed to read directory %s: %w", directory, err)
 	}
-	fmt.Println(directory)
+	// DEBUG:
+	// fmt.Println(directory)
 
 	var (
 		bestMatch            string
diff --git a/profile/binmeta/find_windows.go b/profile/binmeta/find_windows.go
index b00cb166..64117729 100644
--- a/profile/binmeta/find_windows.go
+++ b/profile/binmeta/find_windows.go
@@ -35,8 +35,9 @@ func GetIconAndName(ctx context.Context, binPath string, homeDir string) (icon *
 	}
 
 	return &Icon{
-		Type:  IconTypeAPI,
-		Value: filename,
+		Type:   IconTypeAPI,
+		Value:  filename,
+		Source: IconSourceCore,
 	}, name, nil
 }
 
@@ -63,29 +64,6 @@ func getIconAndNamefromRSS(ctx context.Context, binPath string) (png []byte, nam
 	// 	return true
 	// })
 
-	// Get first icon.
-	var (
-		icon    *winres.Icon
-		iconErr error
-	)
-	rss.WalkType(winres.RT_GROUP_ICON, func(resID winres.Identifier, langID uint16, _ []byte) bool {
-		icon, iconErr = rss.GetIconTranslation(resID, langID)
-		return iconErr != nil
-	})
-	if iconErr != nil {
-		return nil, "", fmt.Errorf("failed to get icon: %w", err)
-	}
-	// Convert icon.
-	icoBuf := &bytes.Buffer{}
-	err = icon.SaveICO(icoBuf)
-	if err != nil {
-		return nil, "", fmt.Errorf("failed to save ico: %w", err)
-	}
-	png, err = ConvertICOtoPNG(icoBuf.Bytes())
-	if err != nil {
-		return nil, "", fmt.Errorf("failed to convert ico to png: %w", err)
-	}
-
 	// Get name from version record.
 	var (
 		versionInfo    *version.Info
@@ -111,5 +89,31 @@ func getIconAndNamefromRSS(ctx context.Context, binPath string) (png []byte, nam
 	})
 	name = cleanFileDescription(name)
 
+	// Get first icon.
+	var (
+		icon    *winres.Icon
+		iconErr error
+	)
+	rss.WalkType(winres.RT_GROUP_ICON, func(resID winres.Identifier, langID uint16, _ []byte) bool {
+		icon, iconErr = rss.GetIconTranslation(resID, langID)
+		return iconErr != nil
+	})
+	if iconErr != nil {
+		return nil, name, fmt.Errorf("failed to get icon: %w", err)
+	}
+	if icon == nil {
+		return nil, name, errors.New("no icon in resources")
+	}
+	// Convert icon, if it exists.
+	icoBuf := &bytes.Buffer{}
+	err = icon.SaveICO(icoBuf)
+	if err != nil {
+		return nil, name, fmt.Errorf("failed to save ico: %w", err)
+	}
+	png, err = ConvertICOtoPNG(icoBuf.Bytes())
+	if err != nil {
+		return nil, name, fmt.Errorf("failed to convert ico to png: %w", err)
+	}
+
 	return png, name, nil
 }
diff --git a/profile/binmeta/icon.go b/profile/binmeta/icon.go
index d92d0e99..64ab6e43 100644
--- a/profile/binmeta/icon.go
+++ b/profile/binmeta/icon.go
@@ -15,8 +15,9 @@ import (
 
 // Icon describes an icon.
 type Icon struct {
-	Type  IconType
-	Value string
+	Type   IconType
+	Value  string
+	Source IconSource
 }
 
 // IconType describes the type of an Icon.
@@ -38,16 +39,46 @@ func (t IconType) sortOrder() int {
 	case IconTypeFile:
 		return 3
 	default:
-		return 100
+		return 9
 	}
 }
 
+// IconSource describes the source of an Icon.
+type IconSource string
+
+// Supported icon sources.
+const (
+	IconSourceUser   IconSource = "user"
+	IconSourceImport IconSource = "import"
+	IconSourceUI     IconSource = "ui"
+	IconSourceCore   IconSource = "core"
+)
+
+func (s IconSource) sortOrder() int {
+	switch s {
+	case IconSourceUser:
+		return 10
+	case IconSourceImport:
+		return 20
+	case IconSourceUI:
+		return 30
+	case IconSourceCore:
+		return 40
+	default:
+		return 90
+	}
+}
+
+func (icon Icon) sortOrder() int {
+	return icon.Source.sortOrder() + icon.Type.sortOrder()
+}
+
 // SortAndCompactIcons sorts and compacts a list of icons.
 func SortAndCompactIcons(icons []Icon) []Icon {
 	// Sort.
 	slices.SortFunc[[]Icon, Icon](icons, func(a, b Icon) int {
-		aOrder := a.Type.sortOrder()
-		bOrder := b.Type.sortOrder()
+		aOrder := a.sortOrder()
+		bOrder := b.sortOrder()
 
 		switch {
 		case aOrder != bOrder:
@@ -68,7 +99,7 @@ func SortAndCompactIcons(icons []Icon) []Icon {
 }
 
 // GetIconAsDataURL returns the icon data as a data URL.
-func (icon *Icon) GetIconAsDataURL() (bloburl string, err error) {
+func (icon Icon) GetIconAsDataURL() (bloburl string, err error) {
 	switch icon.Type {
 	case IconTypeFile:
 		return "", errors.New("getting icon from file is not supported")
diff --git a/profile/binmeta/icons.go b/profile/binmeta/icons.go
index ab25f7ee..595fbb10 100644
--- a/profile/binmeta/icons.go
+++ b/profile/binmeta/icons.go
@@ -92,8 +92,9 @@ func LoadAndSaveIcon(ctx context.Context, iconPath string) (*Icon, error) {
 		return nil, fmt.Errorf("failed to import icon %s: %w", iconPath, err)
 	}
 	return &Icon{
-		Type:  IconTypeAPI,
-		Value: filename,
+		Type:   IconTypeAPI,
+		Value:  filename,
+		Source: IconSourceCore,
 	}, nil
 }
 
diff --git a/sync/profile.go b/sync/profile.go
index fa460417..bfc76893 100644
--- a/sync/profile.go
+++ b/sync/profile.go
@@ -420,8 +420,9 @@ func ImportProfile(r *ProfileImportRequest, requiredProfileSource profile.Profil
 			return nil, fmt.Errorf("%w: icon is invalid: %w", ErrImportFailed, err)
 		}
 		p.Icons = []binmeta.Icon{{
-			Type:  binmeta.IconTypeAPI,
-			Value: filename,
+			Type:   binmeta.IconTypeAPI,
+			Value:  filename,
+			Source: binmeta.IconSourceImport,
 		}}
 	}