I have discovered persistent XSS in blogger domain. I have reported vulnerability to Google Security Team and I received this is the response:
Note that there are no authentication cookies or other sensitive information in these domains; blog management is implemented on blogger.com, instead."
The domain mentioned in your submission is what we call a 'sandbox domain'. These are meant specifically to host user-controlled and potentially malicious content and are isolated from any sensitive data, thanks to Same Origin Policy restrictions
So obviously I did not received the bounty, however I would like to ask what other attack vectors can be useful for attackers in this case apart from phishing?