Hi there,
Just reading through your post, I have the same issue, How do I remove this from whitelist and block permanently.
wp-admin/tools.php request.queryString[download_backup_file] 5/27/2016, 9:40:03 AM Whitelisted while in Learning Mode. – 43.227.253.48
Looks like the IP is pointing to China.