@font-face { src: url(https://evil.com/f.woff2) }