Active scanning tools like nmap can easily crash fragile, legacy industrial hardware. MEA (Modbus Exposure Analyzer) solves this by passively monitoring raw Modbus TCP traffic over structured read cycles. By calculating register data entropy and analyzing the statistical drift of physical sensor noise, the tool accurately differentiates real PLCs from static simulators and honeypots, all without sending a single disruptive active payload.