Solved this myself using an old 5-year-old comment on this site as a starting point... thank you user jscher2000.

(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button promising to be careful or accepting the risk.

(2) In the search box above the list, type or paste blocked and pause while the list is filtered

(3) The browser.newtabpage.blocked preference contains a weird code for each URL you blocked from the new tab page. I have no idea how to figure out which one is which, but you can empty the list by clicking the garbage bin icon next to the preference.

Note for anyone else reading: if you don't have this preference, you probably haven't dismissed any tiles from the new tab page yet.

Note that the weird character value is a hashed value of the important part of the URL and such hashes only work one way for security reason. Malware detection also works with one-way hashes when send to the Google server to confirm a possible positive. You can also see hashes in the name of a JSON backup to prevent saving multiple copies of the same backup and for bookmark and folder items in the JSON backup (guid key; the Library doesn't show them).