I2P users can access specific I2P services that are only accessible on I2P, or access Internet resources without exposing their IP address.  In the case of CryptoWall 3.0, the malware is attempting to access multiple .i2p resources only accessible through I2P, also known as “eepSites.”  The CryptoWall 3.0 uses I2P in the same way CryptoWall 2.0 used Tor, to give victims access to a decrypting service to get their files back.