Приветствую.
Как-то так
if ( $http_referer = (""|"-") ) { set $lock1 1; }
if ( $http_user_agent = ("spybot"| "Mozilla/5.0 (compatible; Googlebot/2.1; +
http://www.google.com/bot.html)") ) { set $lock2 1; }
set $lock3 "$lock1$lock2";
if ( $lock3 = "11" ) { return 403; }