Recent studies have introduced co-location attacks as a powerful way to extract social information from location traces. However, these attacks all rely by some means on the position of targeted users. This requires the attacker to be able to locate either the user or the sensors detecting the user. Implicitly, it also forbids the use of these attacks on devices whose location is unknown. In this paper, we consider attack scenarios where the attacker has no position information on users and devices sensing users. Such attack scenarios typically fit Internet of Things use-cases, where low-end devices are scattered in an environment that is unknown to the attacker: the sole source of information is a set of timestamped user/sensor proximity logs. To exploit proximity logs, we describe LOCA, a location-oblivious co-location attack. Our approach exploits location-oblivious logs in two steps: i) we exploit users' flows between sensors to construct a virtual map of the sensors, and ii) we conduct a co-location attack based on that virtual map. Our tests on both synthetic and real datasets match up to 90% of the targeted social network with a surprisingly low number of sensors. These results greatly extend the scope of such co-location attacks, and hopefully awareness about their threat.