VLESS Maintainer Analysis: Victoria Raymond, RPRX, and mmmray

Looking for the deployment guide? See Irregularpedia: VLESS / Xray Deployment Guide. This post is the unverified-but-plausible research that doesn't belong on a production-config page.

Part 1 of the VLESS Investigation series. This post deals with the identity question: who, if anyone, is the same person across the V2Ray → Xray-core → side-projects timeline.

Read this part first. The connections this post examines — most prominently Victoria Raymond ↔ mmmray, and any of those names ↔ RPRX — are circumstantial, not proven. Coding-style overlap, timezone clustering, and project-graph co-occurrence are signals, not evidence of shared identity. The body of this post tags every claim with one of Verified / Circumstantial / Community speculation / Author guess. If you only read the title, you'll come away with a stronger claim than the body supports. Don't.

Why this question matters

If you're running VLESS in production against a state-level adversary, the maintainer set is part of your threat model. A one-or-two-person project where the same human force-pushes to main is a different supply-chain risk profile than a multi-maintainer org with code review. The Xray-core project has consistently looked closer to the former than the latter.

The three names that come up in basically every long-running Telegram discussion about this:

Victoria Raymond — early V2Ray contributor (V2Ray is the parent project Xray forked from in late 2020 / early 2021).
RPRX — the founding maintainer of Xray-core, on-record as the original author of XTLS and REALITY. (RPRX on GitHub)
mmmray — currently active across the V2Ray / Sing-box / Nekoray / scanner-tool ecosystem. (mmmray on GitHub)

Three names. Possibly two humans. Possibly one. We can't prove the latter — but the evidence is more aligned than not.

The wider team

Even if RPRX is a single point of decision, Xray-core does have other named contributors who are central to the project's day-to-day:

GitHub	Role (per community consensus)
DuckSoft	Protocol designer — credited with the original VLESS design (stateless, UUID-keyed).
yuhan6665	Core developer; active since 2020. Transport-layer focus.
Fangliding	Documentation and Telegram-channel maintenance.

The XTLS/Xray-core contributor graph lists 100+ accounts with at least one merged PR, though the long-tail-of-one-typo-fixes shape is typical. The bus-factor concentration is in RPRX, mmmray, and DuckSoft.

Victoria Raymond → mmmray?

Evidence for connection (circumstantial)

1. Coding style. (Circumstantial)

Both write Go with strikingly similar patterns:

Heavy use of errgroup for concurrent operations.
Terse, functional-style commit messages (fix race in transport, cleanup buf pool).
Preference for small files (~150–300 LOC) with explicit interface boundaries.
Identical idioms for context propagation and shutdown.

Commit corpora:

Victoria Raymond's V2Ray contributions (active 2018–2021, then sparse)
mmmray's GitHub (active 2022–present, across V2Ray, Sing-box, Nekoray, and assorted networking tooling)

This isn't dispositive — Go has a relatively narrow idiom space and a lot of Chinese-diaspora networking engineers write it the same way. But "same patterns" + "same sub-projects" + "non-overlapping active periods" is suggestive.

2. Timezone clustering. (Circumstantial)

Public commit times bunch around UTC+8 (China Standard Time) for both accounts, with the dense band running 22:00–03:00 UTC+8 — i.e., night owl. mmmray occasionally shows UTC-5 clusters (US Eastern), which on a commercial VPN would map roughly to the East Coast US exit nodes that several mainland-China VPN users prefer; this is consistent with a single human switching networks, but is also consistent with two different humans.

3. Linguistic patterns. (Circumstantial)

Both mix English with simplified Chinese in code comments and issue threads, with similar register:

Victoria: mostly English in public, occasional Chinese when responding to mainland-China users on issues.
mmmray: more balanced bilingual usage, including READMEs with Chinese sections on personal repos.

4. Project-graph overlap. (Circumstantial)

Both contributed to NekoRay and to V2Ray's transport layer. The set of projects mmmray touches in 2024–2026 has near-perfect overlap with the set Victoria Raymond was active in during 2019–2021 — same parts of the V2Ray core, similar levels of involvement in Sing-box.

Counterpoints

mmmray's repo list includes non-V2Ray tools — network scanners, tooling for goproxy, and miscellaneous Cloudflare-bypass scripts — that Victoria Raymond never published.
No public statement from either party. We are not aware of anyone in the project's inner ring (RPRX himself, the Sing-box team, the long-time V2Fly maintainers) confirming or denying the connection.
The 2021 forking moment (V2Ray → Xray) would be a natural place for an identity change, and the timing fits, but it also fits the simpler explanation: Victoria stepped back, mmmray showed up, no relation.

Community speculation

GitHub Discussion #2199 (V2Ray-core repo): users debate whether mmmray is Victoria under a new identity. No resolution.
Telegram: @projectXtls: pinned messages and admin Q&As repeatedly sidestep the maintainer-identity question. The pattern is consistent with there being something to hide — or with the maintainers (reasonably) refusing to dignify gossip.

Victoria Raymond's 2019 disappearance — the patent angle

Before RPRX's 2022 hiatus, there was an earlier and more abrupt step-back: Victoria Raymond went quiet in mid-2019, never publicly explained why, and never (under that name) returned.

The most-cited external event in that window:

June 2019: Chinese patent CN110595506A was filed by Beijing Institute of Technology researchers, describing a method for detecting V2Ray traffic — the exact protocol family Victoria had been the most visible maintainer of. The patent application is public; the filing date is unambiguous on Google Patents.

The coincidence of timing is the basis of the most common community narrative: that Victoria stepped back in direct response to a Chinese state actor formally documenting interest in fingerprinting V2Ray. (Community speculation.) We can't confirm a causal connection. What we can say:

The patent is real and public. Verified.
Victoria's public activity tailed off in the same window. Verified (commit history).
The two are connected. Speculation — coincidence is consistent with both "patent caused her to lay low" and "patent was filed because V2Ray was already gaining attention and Victoria stepped back for unrelated reasons during that same period of heightened attention."

It matters for the maintainer-identity question (Part 1 above) because it provides a plausible reason for an identity change to make sense — not evidence that one happened. The patent is the operationally-relevant anchor: a state actor has formally documented an interest in fingerprinting this protocol family. Anyone working on the project from 2019 onwards has been working in that environment.

RPRX's disappearance and return

The most well-documented identity-event in the project's history is RPRX's roughly 3-month absence from late 2022 into early 2023.

What happened (verified)

No commits from RPRX between approximately October 2022 and January 2023. Cross-referenceable on RPRX's GitHub activity history. The gap is unambiguous in the public record.
Project went quiet. No releases, no protocol-change announcements, @projectXtls pinned messages went dormant.

Possible reasons (mostly speculation)

Developer burnout. (Author guess — most likely.)

RPRX had been the central figure of the project for three years at this point. Single-maintainer OSS projects in the censorship-circumvention space have a known burnout pattern — the work is high-stakes, low-funding, and the user community is often demanding.

Legal/regulatory pressure. (Community speculation.)

The 2022 hiatus coincided with GFW updates documented by Citizen Lab that specifically targeted Xray-family proxies. There's no public evidence of legal action against RPRX personally — but a maintainer of a tool that is actively defeating a major nation-state firewall has obvious reasons to lay low when that firewall starts shipping countermeasures.

Upstream protocol refactor. (Circumstantial.)

The 3-month gap closed with the REALITY protocol announcement — a significant rewrite that addresses precisely the active-probing problem the 2022 GFW updates introduced. A coherent reading: the absence was a private development sprint, not a hiatus.

The 2023 return (verified)

RPRX commits resumed in January 2023.
The REALITY protocol shipped shortly after — a substantial reworking of how the project handles TLS-fronting against active probes.
@projectXtls pinned a message describing the period as a "revival" and emphasising the project's continuity.

Triggers for return (speculation)

Community demand. Users needed REALITY to stay ahead of the GFW's 2022 probing changes.
Competitive pressure. Sing-box launched in May 2023 with its own implementation of similar primitives. A coherent reading: RPRX returned partly to keep Xray-core the canonical implementation.
Funding. Recurring community speculation about Bitcoin / Monero donations enabling the work. The project has at times publicly posted crypto addresses; the flow of funds isn't observable from outside.

What we can say with confidence

Claim	Confidence
RPRX exists as a coherent online persona, active 2020–present (with the 2022 gap).	Verified
RPRX is the founder of XTLS and REALITY as protocols.	Verified
Victoria Raymond was active in V2Ray pre-fork; activity tailed off after the Xray fork.	Verified
mmmray became active across the same project ecosystem in roughly the same window Victoria Raymond went quiet.	Verified
Victoria Raymond and mmmray are the same human.	Circumstantial — leaning yes.
RPRX and either Victoria Raymond or mmmray are the same human.	Community speculation — no strong signal either way.
RPRX's 2022 hiatus was specifically caused by legal pressure.	Community speculation — coincidence is consistent with multiple explanations.

What this means operationally

If you're running Xray-core in production:

Treat the upstream as a single point of failure. Whether that point is one human or two, it isn't a three-person org with redundancy.
Mirror your build sources. Don't go install github.com/XTLS/Xray-core@latest in production. Pin a tag, mirror the source tree, build from your mirror.
Have a Sing-box migration plan you've actually tested. If RPRX disappears again — for any reason — you want the cutover to be hours, not weeks.
Read protocol-change announcements before bumping. The project has shipped breaking protocol changes (vmess → vless, xtls-direct → vision, tls+ws → reality) every 12–18 months on average.

The cryptography is sound. The protocol design is genuinely innovative. The supply chain is one human writing it, and possibly that human is two humans, and possibly one of those is a third person we don't know about. Plan accordingly.

External references

The most-cited "is this thing trustworthy?" technical writeups, for further reading:

objshadow — "How REALITY Works" — a 2023 independent technical review of the REALITY protocol. Found no backdoors. Explicitly noted the lack of a formal protocol specification as a concern.
chengxiaobai — "The V2Ray / Trojan / Xray trouble-maker" — independent audit-flavoured writeup. Covers the same trust territory from a different angle.
V2Fly Discussion #2199 — the GitHub-issue thread where the mmmray ↔ Victoria identity question gets re-litigated every few months.
Chinese patent CN110595506A — the June 2019 V2Ray-detection patent referenced above.

Neither audit is dispositive. The combination is what the community has, and it is what you have when deciding whether to run Xray-core in production.