gocozumel on "Firewall whitelisting"

The firewall is in the leaing mode. I have not added anything to be whitelisted, but things are showing up as being whitelisted.

I am very, very new at this, but trying to lea and studying every day. It looks as if IPs that I don't recognize are trying to access wp/admin URLs

I checked, and neither of these IPs have been blocked, although a lot of others have been blocked for trying to log in or post. How can I tell if I should block the IPs that are listed? They are:

User IP is 38.95.109.70
User IP is 195.154.169.238

Today, the leaing mode listed as whitelisted quite a few requests from an IP in Russia I permanently blocked a long time ago.

46.161.9.8

I've read information about the whitelisting several times, and still don't understand how it works. If there is a check mark in the square at the right of something that is the whitelisted section, does that mean the IP has been whitelisted and was able to get what they requested. If not, what does the check mark do.

Since I've permanently blocked that IP, I don't understand why it is listed there. Can you help?

Thank you