In recent years, there has been a significant increase in the detection of child sexual exploitation material (CSEM), with perpetrators increasingly turning to advanced encryption technologies to conceal their activities. This study delves into data from a Brazilian Federal Police operation on the Tor network, aimed at disrupting these illicit activities. We uncovered patterns indicating strong user preferences for certain content categories, suggesting the existence of distinct groups with shared interests. Additionally, our findings reveal consistent activity patterns among users, including specific 24-hour, 12-hour, and 6-hour consumption cycles. This research offers insights into the online behavior related to CSEM, providing a foundation for further investigation and the development of effective policy measures.